Open a ledger subject

Requires a workspace-bound API key with ledger:write and an owner, admin, or member role. Appends a subject line with a class and no attributes: opening a row is not a finding. Names and identifiers arrive later as designators and claims. With entityId, the subject is anchored to that catalog entity; the entity kind must align with the class (for example, a vendor anchors an organization; a CVE anchors nothing). Send an Idempotency-Key header to make retries safe; a replay returns 200.