Feature/Fix: Validate lineage accounting on frozen local histories

[iam-brain]

Summary

• add an opt-in, aggregate-only frozen-history replay for comparing legacy, ledger, and private OpenAI UTC totals without exposing rollout contents, identities, paths, models, or account totals
• stop treating retained metadata IDs shared by fork siblings as physical ancestry edges
• key contained-family fallback by physical owner and scope so sibling rollouts cannot envelope one another
• keep legacy removal explicitly blocked pending repeat validation, ordinary-day reference totals, and acceptable performance

Real-world result

On the frozen July 9–11 UTC history, ledger selection reduced aggregate absolute error by about 65% relative to the legacy scanner and finished about 3.1% below the OpenAI aggregate.

The remaining evidence is not strong enough to promote the ledger yet. July 9 remains 10.4% low and unchanged from legacy, which points to discovery, parsing, or reference semantics outside lineage deduplication. July 11 is 4.4% high. July 5–8 diverge enough from legacy that they need OpenAI daily totals before they can be classified as corrections or regressions. The replay therefore emits supportsLegacyRemoval: false.

The frozen replay covered 819,779 observations across 37 families. It also showed that the current lineage path is materially slower than legacy scanning on this corpus, so performance remains a promotion blocker.

Tests

• swift test --jobs 4 --filter 'CodexLineage(Ledger|AccountingSelector|LocalValidation)Tests' (32 tests passed)
• make check
• opt-in frozen local replay
• make test (647 selections in 54 groups; 54 passed, 0 failures, 0 retries)

Part of #23. Stacked on #37.