Add a durable Baton ledger and recoverable work queue

[hyperpolymath]

Outcome

Replace temporary files and in-memory submission state with a durable append-only Baton ledger and recoverable work queue.

Scope

• Define versioned records for submissions, claims, execution attempts, frozen envelopes, verification, reporting attempts, and terminal outcomes.
• Store idempotency keys, causal links, target repository/SHA, node identity, timestamps, and envelope digests.
• Make restart recovery deterministic: queued and in-flight work is either resumed safely or marked for explicit repair.
• Prevent freeze-path collisions and path traversal from check IDs.
• Add retention, compaction/export, and tamper-detection policies without discarding authoritative history.
• Keep the storage adapter behind a typed port; the database is not the domain model.

Acceptance criteria

• Process restart tests reproduce queue and result state without double execution or double posting.
• Concurrent checks cannot overwrite each other’s envelopes.
• Imported/exported ledger fixtures verify hash/digest integrity.
• Storage corruption and schema-version mismatch fail closed with actionable diagnostics.