feat(proof): proof receipts, so CI can skip work a machine already proved

[SpoBo]

Implements #17, after a design review with the user (v2, "simple integration").

What a repo adds

# 1. Where the job's command runs, in CI and in the local pipeline:
taskguard --receipt unit-tests -- <the command, unchanged>
# 2. One step in a small first CI job:
taskguard proof check unit-tests --github-output
# 3. On the heavy job:
#    if: needs.<that job>.outputs.unit-tests != 'skip'

What taskguard does

• Run. Hashes the files on disk before and after the command (temp index; the real index does not change). Same hash: a receipt, green or red. A file changed during the run, or an ignored .env* file: no receipt.
• Publish, by itself. Laptop: a background process watches the branch on GitHub (1 h) and posts taskguard/ID when the head has exactly the tested files; no checkout needed. GitHub Actions: posts at once on the PR head. --no-publish keeps it local.
• Check. Reads the PR head and labels from the Actions event, waits up to 30 s. Green (from an OS --os accepts): skip. No status, red, a taskguard:ci[:ID] label, a gh error: run.
• proof publish (by hand), proof show, proof log ID (commits on main, least proven first).

Not in the issue's design, on purpose

• No policy file, no --partial/levels, no install/uninstall, no push hook. The receipt name is the contract.
• A red status does not skip CI.
• Storage: tables receipts and receipt_posts (new, additive).

Tests

Unit: status description, skip/run decision, Actions event, log ranking. CLI with a real git repo and a fake gh: receipt tree equals the later commit tree, index untouched, change during the run, red receipt, .env, background publish once the branch has the files, CI posting on the PR head, check with labels from the event, publish by tree without a checkout.

🤖 Generated with Claude Code

[SpoBo]

Closing for now. DALP chose a simpler route: a "verified" block in the PR description that its CI planner checks (settlemint/dalp#16490). The live demos on this branch led there. The branch proof-receipts stays, so this can come back if a repo needs receipts.