Verify the ledger seal

Requires a workspace-bound API key with `ledger:read`. Recomputes the SHA-256 seal for lines after `afterSeq`. Checks canonical JSON, line hashes, consecutive `seq` values, and each `prev` reference to the previous line. Rules that look up earlier records are enforced at append time and by the offline checker over a full export.