ledger(policy): verdict immutability per head SHA — re-evaluations require a reason code and leave a trail

[JSONbored]

Problem

A verdict's integrity is provable, but its uniqueness is not: nothing currently distinguishes "this PR was evaluated once" from "this PR was evaluated several times and one result was kept."

Scope

• Invariant: one canonical verdict per (PR, head SHA). A repeat evaluation of the same head SHA is only possible through an explicit re-evaluation path that records a machine-readable reason code (e.g. pipeline_error, config_change), the prior verdict id, and the actor
• Re-evaluations never silently replace: the ledger keeps the full chain (verdict N supersedes verdict N-1, both retained, both anchored)
• New head SHA (force-push / new commits) naturally starts a fresh verdict — that path is unchanged and needs no reason code
• Enforcement lives at the ledger-write layer so no caller can bypass it
• Tests: duplicate evaluation without reason code is rejected; reason-coded re-run produces a linked chain; new-SHA evaluation unaffected

Acceptance

For any PR, the public record shows exactly how many evaluations each head SHA received and why any beyond the first occurred.

[linear-code]

JSO-6803