feat(audit): books.audit, the attestation tools and the CPA gate (P8)

The whole re-audit through the tools: books.audit previews its checks, then
with the preview's digest runs them, files the workpaper and journals the
run; the same books, day and scope return the run that exists.
books.attest_receipt, books.review_entry and books.attest_period record a
named client's claim with its self-reported method; books.attestations
weighs each against policy.attestation_bar as it stands. Under
policy.cpa_package_requires_audit = refuse, books that declared audits
cannot export the CPA package without a counted audit for the handoff at the
current head unless a reason is given, which is journaled as a decision
(D-9). Needs attention asks for the month-end attestation, the annual audit
and the audit before the handoff. Rules B-45, the handbook section, the
interface, parity, receipt-store and testing records, and the As-built
block. Merge needs no go-ahead: the live books refuse the new writes until
the owner gives it.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp

bookspec/spec/ledger.md

@@ -132,10 +132,11 @@ how the books are kept.
 
 ### BS-ledger-13: Audits and attestations (B-45)
 
-- **Status:** reserved
-- **Statement:** Reserved: allocated in the wanderbooks plan (8.0.3), not yet stated in `docs/spec/rules.md`.
+- **Status:** CONVENTION
+- **Statement:** An audit of the books through a day MUST give the same findings for the same books and programme; a claim that someone checked MUST rest on the books as they were when the audit ran, MUST NOT count when what it read disagrees with the books, and its method is the claimant's own word.
 - **Sources:**
-  - none yet
-- **Symbolic form:** none yet.
-- **Examples:** none yet
-- **Applicability:** none yet.
+  - external: Revenue Procedure 98-25, section 5.01, machine-sensible records with an audit trail
+  - vendored `sources/irs-records.md`: "In addition, you must keep supporting documents"
+- **Symbolic form:** `findings(books, through) = f(books, through, programme)`; `counted(a, bar) = meets(method(a), bar) and not disagrees(a)`.
+- **Examples:** none yet. The example schema has no audit event or query; an audit example waits on a schema extension.
+- **Applicability:** engines that are audited.