feat(tally): add sealed ledger canary readback profile

[lamemustafa]

Closes #53

Functional summary

Adds ledger_canary_readback_v1: a sealed, read-only TDL export profile for verifying one separately approved, Bridge-generated synthetic ledger write canary. The profile:

• validates the synthetic ledger name against a narrow literal-safe character set;
• validates and redacts the fixed 64-hex query-identity digest;
• applies an exact ledger-name filter and binds that digest to the returned company context;
• remains an EXPORT request with no general ledger query or write dispatch path.

Validation

• cargo fmt --all --check
• cargo test -p bridge-tally-protocol
• cargo clippy -p bridge-tally-protocol --all-targets -- -D warnings
• cargo check --workspace
• git diff --check

Migration and rollback

No data migration, persisted-state change, endpoint change, or command routing change. Roll back by reverting this single commit; it is not reachable from the runtime yet.

Security and Tally impact

This is intentionally a closed read-only profile. Dynamic values are syntactically constrained before XML rendering; the tests assert exported requests only and pin the template digest. No real Tally/company/ledger/credential data is included. Education-mode compatibility is unobserved and remains explicitly unknown pending the disposable-company canary flow.

Review checklist

• Errors are actionable without exposing sensitive values.
• New or changed commands validate inputs and surface user-safe errors.
• AXAL protocol changes include a contract-level regression command or test.
• No secrets, credentials, certificate data, personal data, customer data, local usernames, or absolute machine paths appear in source, fixtures, logs, screenshots, documentation, or Git metadata intended for publication.
• Endpoints and command handlers enforce explicit input validation.
• DSC, Tally, credential, endpoint, and document changes include explicit security impact notes.
• Shared build and check commands pass without shell-specific syntax.
• Platform-specific behavior is not changed; this portable protocol-only change has no missing platform evidence.
• Existing workflow changes include rollback and migration compatibility.

[lamemustafa]

CI rectify update: regenerated the compatibility surface and its matrix binding for the new sealed read profile. Local verification now passes the exact compatibility gate, matrix drift check, no-write live-read boundary check, protocol tests, formatting, and clippy. @codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f68377a2a1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[lamemustafa]

Both Codex findings were fixed in 452baa0, with targeted regression coverage and regenerated compatibility bindings. @codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 452baa08a1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".