levain 0.6.3

The framed team export, the other half of anneal-memory's team-import contract v2 (0.9.38, with the 0.9.39 fix).

Changed

• levain team export --jsonl now emits the framed stream (anneal's contract v2): the header {"anneal_team_stream":2}, then one envelope {"frame": <ledger file>, "n": <line number in that file>, "line": <the ledger line, as a JSON string>} per verified entry, one unbroken run per ledger file, in file order. anneal-memory team-import - now requires exactly one root and one author per file, so a second root planted in one file is refused (before, anything after a first valid root in a stream was only judged by its chain). The envelope is built with json.dumps, so ledger text can never become structure. The SessionStart import into the member's anneal store uses the same stream. --in-force is unchanged and unframed (it is a reading convenience that cannot be chain-verified). Anyone piping the old unframed export by hand keeps working: anneal 0.9.38 still reads unframed input, with a stderr note that a second root in one file is not detected. A ledger file whose path does not fit anneal's label rule (a member can push any *.jsonl name under ledger/) is exported under an opaque unnamed-<index>-<sha256> label (unique by construction) rather than failing the export or the SessionStart import. Opaque labels are not stable across exports (the index is the file's position in the sorted list, so adding a ledger file that sorts earlier renumbers them); anneal's contract uses the label for grouping and report text only. Known limit, not new in 0.6.3: the ledger is rebuilt from git log -p, and a ledger file whose name git must quote (a space, a non-ASCII character) is not read at all, so its entries are neither enforced nor exported. The internal levain.team.export.export_lines is now export_stream (it returns the framed stream). Framing checks structure, not authenticity: the stream is still one trust unit the exporter vouches for.
• Levain now requires anneal-memory 0.9.39 or later (anneal-memory>=0.9.39,<0.10), and 0.9.39 is the version it is tested against: 0.9.38 is the first release that reads framed input, and 0.9.39 fixes a library-only regression in it (an endless blank-line iterable looped in import_ledger; the CLI path was not exposed). No migration-manifest entry and no schema changed, so existing installs' seeds are unchanged.