feat: add acceptance campaigns and benchmark spend guards

[tcconnally]

Summary

Implements the acceptance-campaign contract for #256 and #257 without changing existing receipt/hash-chain semantics.

What changed

• Adds public-safe, hash-bound campaign manifests, independent cell/lane checks, versioned continuation lineage, and receipts in ledger_agent/campaigns.py.
• Adds SQLite persistence for campaigns/checks, durable budget stop state, campaign-scoped usage fields, and schema version 23 migration support.
• Binds Meter local/remote usage to campaign lineage and rejects unknown campaigns, malformed bindings, budget guard overruns, missing usage, mismatched spend, and forged pass receipts.
• Adds campaign summary/audit selectors, HTTP endpoints, SDK support, MCP/server schema parity, OpenAPI definitions, and public documentation.
• Keeps prompts/provider payloads out of campaign manifests, checks, receipts, and summaries.

Verification

• uv run --frozen --with pytest pytest -q — 848 passed
• Adversarial boundary probes — passed (type confusion, digest tampering, raw-payload rejection, binding tampering, unknown-campaign writes)
• OpenAPI YAML parse — passed

Resolves #256
Resolves #257