feat: add durable bridge ledger scaffold

[Jdelg718]

Summary

• Adds Phase 14 durable bridge ledger scaffold backed by SQLite.
• Claims approved-action audit IDs durably before any future provider mutation.
• Dedupe is keyed by audit_id and fails closed on duplicate, unsafe, unsupported, or out-of-bundle actions.
• Adds explicit status transition guards and tests for terminal/manual-review states.
• Updates docs/roadmap/handoff for the Phase 14 safety boundary.

Safety Boundaries

• No OAuth implementation.
• No provider credentials.
• No Gmail/Microsoft/IMAP/SMTP/n8n/provider calls.
• No live provider mutation nodes.
• Ledger stores IDs/status only — no message body, subject, headers, tokens, API keys, passwords, or cookies.

Verification

• python3 scripts/validate_n8n_workflow_exports.py
• python3 -m py_compile outreach_filter.py botfucker/*.py scripts/validate_n8n_workflow_exports.py
• python3 -m unittest discover -s tests -v

Team Review

• Rex: PASS — no blockers; concurrent claim sanity check passed.
• Gus: APPROVED — no ops/n8n blockers.