feat: add opt-in reconciliation recovery state ledger

[Pigbibi]

Summary

• consume only a private, immutable recovery ledger when an explicit URI is configured
• derive the target change from the current frozen baseline, allowing only RECONCILE_ONLY to ACTIVE_LKG
• inject the verified five reconciliation digests and fail closed for target drift, replay, malformed plans, or multi-service mismatch
• retain legacy behavior exactly when no ledger path is supplied

Verification

• targeted state-ledger and Cloud Run sync-plan tests
• workflow guard script
• Ruff checks

No ledger URI or state object is configured by this PR, and no broker or order operation is added.