receipts: deferred scope from the dev-receipts build (tracking)

[bordumb]

Deliberate deferrals from the auths-receipts portfolio build (branch dev-receipts), each fail-closed where it matters:

• Witness / on-chain anchor tiers: auths_evidence::verify_anchor supports treasury + first-seen; witness/onchain verify fail closed as anchor-unverifiable. Wiring the transparency-log checkpoint (SignedCheckpoint + cosignatures) is next.
• Treasury anchor scope: cumulative-equality assumes single-delegation scope (fleet of one). Multi-delegation fleets need the fleet-wide sum across every delegation log.
• Money-weighted truncation bound: a zero-cost-call tail truncation is invisible to the treasury cumulative check (documented in anchor.rs); the composite head still catches it whenever the bundle is compared against a later head.
• receipts-api observability: Prometheus /metrics + generated OpenAPI (utoipa) deferred; a minimal hand-maintained /openapi.json ships. tracing spans not yet wired.
• receipts-api tests: the RC-E3.3.9 live-Postgres integration suite (build → get → find-by-disputeRef → verify → export → usage; HTTP threat cases) is not yet written; unit-level coverage rides the evidence/escrow suites.
• Reversal rail adapters: ClaimOnly + EscrowRelease ship; StripeRefund / X402Refund are rail-credential-gated stubs (hints degrade to claim recording).
• Org-deep party resolution (RC-E3.5.2): payerPrincipal = the verifier-proven subject root (correct for individual and org roots); member-level OrgMemberAuthority apportionment via walk_delegation_chain is left to org policy.
• sqlx feature constraint: sqlx uuid/chrono/json/migrate features pull sqlx-sqlite into version resolution and its libsqlite3-sys links collides with the workspace sqlite crate — receipts-api binds text + casts and runs DDL manually (see the manifest note).
• Concurrency-fork e2e (row 4b): the pipelined-producer regression runs in auths-site tests/performance/scenarios/chain.mjs; the hermetic gate covers the sequential linear-chain leg.