store: refusals leave the live books untouched; per-filing names; spec suite

The refusal property gained the converse law (an accepted command
journals something; only batch runs may find nothing to do) and checks
the store's class and payroll listings. It found a schedule registered
with an out-of-range total whose first month was refused after its entry
was begun: the live ledger kept a draft the journal never had.

- Core: compound commands (post_schedule_month, reverse_entry,
  close_period_to, create_invoice, create_bill, receive_payment,
  pay_bill, run_payroll, remit_payroll_taxes) run inside
  Ledger::atomically, so a refusal partway leaves the ledger exactly as
  it was.
- Core: a schedule total no line could carry, or finer than a cent, and
  an asset cost beyond the line range, are refused at registration.
  Replay keeps older schedules (replay_register_schedule).
- Store: add_line, add_line_fx, mark_cleared, set_fx_rate,
  post_schedule_month and close_period_to changed the live ledger before
  journaling; they now run on a copy, journal what it produced, then
  swap it in, so a failed write leaves the live books as journaled.

New spec-blind suite tests/spec_store.rs (57 tests written from the
store's specs alone). Its two findings, adjudicated:
- A file filed twice under different names listed the first name and
  type for both (the projection kept them per blob). Schema v8 gives
  each attachment its own; older databases backfill and heal by verify.
- Withdrawn attachments stay in the store's listing, marked (the MCP
  listing hides them): the spec and doc said "omit" and are corrected.

Also removes journal::truncate_to_last_good_seq: unused, and it dropped
everything after the first bad complete line, which the books now treat
as corruption for a person, never repaired automatically.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX

crates/ledger-store/tests/store.rs

@@ -1351,6 +1351,8 @@ mod refusals {
         }
         let tb = ledger_core::reports::trial_balance(l);
         prop_assert_eq!(tb.total_debits, tb.total_credits);
+        prop_assert_eq!(store.list_classes().len(), l.list_classes().len());
+        prop_assert_eq!(store.list_payroll_runs().len(), l.list_payroll_runs().len());
         for id in 1..l.next_entry_id() {
             if let Some(e) = l.get_entry(id)
                 && e.status() == ledger_core::EntryStatus::Draft
@@ -1432,6 +1434,16 @@ mod refusals {
                     Err(e) => eprintln!("REFUSED {kind} {e}"),
                 }
             }
+            // The converse law: an accepted command is on the record. Only
+            // a batch run may find nothing to do.
+            if result.is_ok() && !matches!(op, Op::RunDepreciation(..) | Op::RunRecurring(..)) {
+                let after = std::fs::read_to_string(&journal).unwrap();
+                prop_assert!(
+                    after.len() > before.len(),
+                    "accepted {:?} but journaled nothing",
+                    op
+                );
+            }
             if let Err(e) = result {
                 let after = std::fs::read_to_string(&journal).unwrap();
                 prop_assert!(