fix(gateway): expose canonical tool-ledger ingest CLI

[vibeforge1111]

What changed

• registers the documented spark-intelligence gateway ingest-tool-ledger command
• accepts one JSON object from stdin or a file, with a 1 MiB input bound
• sends the bound ledger through the existing Harness schema, authorization-binding, and execution-status checks before persistence
• returns safe machine-readable or human-readable results without leaking a traceback on malformed input
• adds CLI coverage for a valid persisted row and malformed-input rejection

Why

The merged R30 Spawner emits its canonical governed tool ledger through this documented Builder command. Builder already contained the validated ingest service and route, but the CLI parser and dispatch registration were missing, so the real Spawner-to-Builder path exited before validation or persistence.

This restores that existing integration contract without weakening Governor authority or creating a competing ledger implementation.

Validation

• exact source tree matches the locally proven candidate tree
• 119 passed across:
  • tests/test_gateway_tool_ledger_cli.py
  • tests/test_gateway_routes.py
  • tests/test_cli_smoke.py
• source artifact build succeeded:
  • wheel SHA-256 ac00bb29078a797dc28c42ddb37be0bfd475cdc6ebf4d59293e60cd4d743706a
  • sdist SHA-256 a2a8b3ec51e2e62e9e391e887c743e19f08651eec1bef5002387ff79683bf6e1
• isolated wheel installation succeeded with the merged Character and Harness pins
• real Node-generated Spawner spawner.dispatch / launches_mission bound ledger persisted through the installed Builder CLI with exact identifiers and not_started status
• malformed JSON returns exit code 2 with a bounded safe error and no traceback
• public team points verified unchanged at 24,409

The cross-repository proof explicitly pinned merged Harness f3641143f1c3f28f55178faefcea57fd443c98bc. A stale local Harness checkout was also detected and remains a separate supervised runtime-sync gate; it is not hidden or overwritten by this PR.

Rollback

Revert the single PR commit. The existing ingest service and route remain intact, while the CLI command becomes unavailable again. No public points or production runtime state are changed by this PR.

Credit

No new point proposal in this batch. Contributor credit remains append-only and will be proposed only after adopted work is shipped and deduplicated.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.