Open a ledger subject

Requires a workspace-bound API key with ledger:write and an owner, admin, or member role. Appends a subject line with a class and no attributes: opening a row is not a finding. Names and identifiers arrive later as designators and claims. With entityId, the subject is anchored to that catalog entity. The entity kind must align with the class (for example, a vendor anchors an organization. A CVE anchors nothing). Send an Idempotency-Key header to make retries safe. A replay returns 200.