ledger: git-commit anchoring backend, cross-verified against GH Archive / Software Heritage

[JSONbored]

Context

Sub-issue of #9267 (external decision-ledger anchoring). Secondary, complementary anchoring backend: a git commit to a public repo, appending each checkpoint's anchor payload. Alone this is weaker than Rekor (GitHub is a trusted third party; git push --force rewrites it) — but per the research on #9267, it becomes genuinely strong combined with mirrors nobody at LoopOver controls: GH Archive (hourly PushEvent records) and Software Heritage's "Save Code Now" (on-demand public-repo archival). A rewrite becomes independently detectable.

Requirements

1. Append, never force-push or rewrite. Each checkpoint appends one line/entry to anchors.jsonl (or one commit) in a public repo, via the Contents API using the existing GitHub App installation token (@octokit/core already a dependency — no new one).
2. The committed content is the same canonicalized anchor payload as ledger: versioned + signed anchor payload, public key + rotation route #9270, plus the signature — identical to what gets submitted to Rekor, so the two backends anchor the same fact.
3. On any error, write a status: 'failed' row via ledger: anchor persistence + public attempt log (success and failure both visible) #9271's persistence, same posture as the Rekor backend — this must not throw past the caller.
4. Document the independent-mirror verification step: cross-checking a specific push against data.gharchive.org's hourly export, so a verifier isn't solely trusting the anchors repo's own git history.

Deliverables

• Git-commit backend implemented, persisted via ledger: anchor persistence + public attempt log (success and failure both visible) #9271
• Tests: successful commit is recorded with its SHA; a commit failure (rate limit, auth) records a failure row and does not throw past the caller
• Documented cross-mirror verification procedure (GH Archive query) in this issue's own PR

Expected outcome

A second, independent, freely-verifiable anchor for the same checkpoint, whose tampering is detectable by anyone checking an archive LoopOver does not control.

References

Sub-issue of #9267. Depends on #9270 (payload), #9271 (persistence). Full mechanism research: decision-record comment on #9267.

[linear-code]

JSO-6436