XY-690: Port Radar ledger and GitHub artifact utilities to decodex radar

Cargo.toml

@@ -18,11 +18,13 @@ clap               = { version = "4.6", features = ["derive"] }
 color-eyre         = { version = "0.6" }
 globset            = { version = "0.4" }
 libc               = { version = "0.2" }
+regex              = { version = "1.12" }
 reqwest            = { version = "0.13", default-features = false, features = ["blocking", "json", "rustls"] }
 rusqlite           = { version = "0.40", features = ["bundled"] }
 serde              = { version = "1.0", features = ["derive"] }
 serde_json         = { version = "1.0" }
 sha1               = { version = "0.11" }
+sha2               = { version = "0.11" }
 tempfile           = { version = "3.27" }
 time               = { version = "0.3", features = ["formatting"] }
 toml               = { version = "1.1" }

README.md

@@ -203,7 +203,7 @@ Codex automation reviews source evidence:
   `artifacts/github/review-queue/openai-codex-latest.json`.
 - `dev/skills/README.md` routes the repo-local Radar and editorial instructions. They
   are not part of the installable Decodex plugin distribution.
-- `scripts/github/build_change_bundle.py` builds normalized GitHub bundles under
+- `decodex radar bundle build` builds normalized GitHub bundles under
   `artifacts/github/bundles/` when a queued subject needs full source context.
 - `scripts/github/backfill_release_range.py` fills release-window gaps before a
   release or prerelease summary, but daily Radar still starts from the commit stream.
@@ -213,9 +213,9 @@ Codex automation reviews source evidence:
 - `scripts/github/render_signal_entry.py` renders reviewed analysis drafts into site
   content.
 - `scripts/github/validate_signal_entry.py` validates the published signal collection.
-- `decodex radar validate` provides the Rust-owned foundation for validating checked
-  Radar artifact contracts while the Python scripts remain the active workflow
-  entrypoints.
+- `decodex radar bundle validate`, `decodex radar ledger ...`, and
+  `decodex radar validate` provide the Rust-owned command surface for bundle
+  validation, local ledger maintenance, and checked Radar artifact validation.
 - `docs/spec/social-publishing.md` and
   `docs/runbook/social-publishing-workflow.md` govern automated low-frequency X
   publication for `@decodexspace`.

apps/decodex/Cargo.toml

@@ -26,11 +26,13 @@ clap               = { workspace = true }
 color-eyre         = { workspace = true }
 globset            = { workspace = true }
 libc               = { workspace = true }
+regex              = { workspace = true }
 reqwest            = { workspace = true }
 rusqlite           = { workspace = true }
 serde              = { workspace = true }
 serde_json         = { workspace = true }
 sha1               = { workspace = true }
+sha2               = { workspace = true }
 time               = { workspace = true }
 toml               = { workspace = true }
 toml_edit          = { workspace = true }