feat(authz): session-scoped action composition closure with trusted action taxonomy (#266)

[tcconnally]

Closes #266

Summary

Adds Ledger-owned, hash-only action-composition admission for protected effects. The contract is trusted and versioned: server-owned action profiles resolve tool/resource semantics, while unknown, aliased, ambiguous, malformed, or unprofiled inputs fail closed.

Implementation

• Adds ledger_agent.composition with canonical action/resource digests, trusted profiles, unordered prohibited-pair checks, ordered-subsequence checks with interleaved noise, task/session lineage, authenticated reset/override handling, idempotency/conflict detection, and serialized cumulative-budget admission.
• Integrates composition verdicts through metering, prebind, receipts, local/remote SDK paths, MCP, and the /v1/composition/admit HTTP surface.
• Advances the Ledger schema from v23 to v24 with durable lineage/admission state and hash-only usage bindings.
• Updates OpenAPI, server metadata, schema documentation, and the action-composition contract documentation.
• Preserves raw arguments and credentials outside durable projections; persisted and returned verdicts contain canonical hashes and bounded metadata only.

Verification

• Full local suite: 914 passed (6 pytest temporary-directory cleanup warnings only).
• OpenAPI composition contract parsed and checked, including the minimal review/hold verdict shape and allow-only hash-bound fields.
• Final candidate tree was clean and independently fingerprinted before publication.

Risk and exclusions

• This does not replace Vault authority manifests/AAR, evidence levels, tool receipts, or backend authorization.
• It does not claim to detect parameter-level exfiltration or all harmful single actions.
• Existing v23 deployments must run the documented v24 migration path.