fix: publish Guard-compatible canonical authority

[Wright-Shawn]

Summary

Closes the concrete Ledger v0.5.0 → Guard v0.13.0 Golden Path incompatibility and adds the canonical cross-repository fixture.

The real publication pipeline previously emitted a nested authority contract without schema_version. Guard could verify the bundle identity but rejected the contract at evaluation because the runtime intake requires compiled_authority_contract.v1.

This PR:

• Stamps the canonical compiled_authority_contract.v1 identity at Ledger's publication boundary when an installed compiler omits it.
• Rejects a conflicting compiler schema instead of silently relabeling it.
• Recomputes the contract hash after the schema identity or lineage is stamped.
• Adds publication regression coverage for the nested contract schema.
• Publishes and preserves the canonical finance-policy@1.0.0 fixture: registry, contract, authority_bundle.v1, and publication receipt.
• Locks registry, contract, bundle, publication, and path invariants.

Verification

• Ledger publication/registry/semantic suite: 34 passed
• Guard v0.13.0 loaded the generated bundle unchanged and evaluated a blocked execution.
• Guard receipt schema: guard_enforcement_receipt.v1
• Publication: pub_20260717_0001
• Contract hash: sha256:c26887c13491fb5db61f46e3cc83a5769fd4071087e978e9de8db2e5ab20248a
• Bundle hash: sha256:7c2ec612a5a58f806a89ad245a63dbecda969bdaf4d06b4d2c04beaab0e229b7

Tracks Waveframe-Labs/Waveframe-Internal#1.