feat(guardian): one AttemptLedger for every guardian repair budget

[WiktorStarczewski]

The four hand-rolled guardian retry/budget ledgers become one AttemptLedger module, closing the defect class rounds 9–14 of #786's review re-fixed piecemeal: the same charge/refund/keying/reset rules were hand-rolled into four module-level Maps, and each mechanism got a different subset wrong (the F-058 → F-172 chain).

• lib/miden/guardian/attempt-ledger.ts — createAttemptLedger(policy, clock?): mayAttempt / begin → handle (chargeEarly, settle('charged' | 'refunded' | 'closed')) / budgetSpent / clearForAccount. Encoded once: charge at SETTLE (a slow /configure still buys its full gap), refund attempts that never reached the operator, close a budget an attempt proved unwinnable, key by the full subject (account + endpoint + guardian key), reset per account regime. Flat and doubling curves; pure, clock-injected (lazy Date.now read so module-scoped ledgers stay spy-visible).
• createRateCooldown — the 429 path's deadline (floor 30s / cap 120s), monotonic clock, lazy expiry; a rate limit is the operator asking for silence, not a failed repair, so it deliberately carries no attempt count.
• guardian-sync.ts migrations: cold re-register budget (persistence gate stays on consecutiveAuthFailures; retry+cooldown on the ledger, now endpoint-scoped), missing-registration push (composite subject, begin-stamp-before-guards, chargeEarly-before-await, settle-time re-stamp — all preserved bit-for-bit against the round-13/14 timing tests), 429 cooldown.
• decideColdReRegisterSelfHeal and the bespoke state types are gone; its boundary tests are ported into the ledger's own suite (1ms-before-cooldown, refund-forever, closed-jumps-to-cap, doubling sequence, prefix clears).
• attempt-ledger-fence.test.ts pins the two repair modules to their exact remaining module-level Maps (streak counters + identity state only; guardian-drift's probe-cooldown pair stays deliberately — arm-on-entry semantics and a constant that doubles as the persisted-run contiguity floor). A new hand-rolled ledger fails CI with the fence in the diff.

604→605 suites / 10,002 tests, ts, lint, i18n all green — the existing guardian-sync timing suites (fake clocks, thresholds, endpoint-change resets) pass unchanged, which is the behavioral-equivalence claim.

Part 3 of 4 of the seam plan from #786's review. Stacked on #796 (Seam B).

Reviewers: the settle-outcome mapping is the part worth your time — attempted→charged, refused-permanently→closed, refused-transiently→refunded, and preflight-refused on the push path; a wrong mapping either burns budget on local failures or retries a provably-dead repair.