Promote the lineage ledger to production accounting

[iam-brain]

Question

Promote accepted ledger totals behind an internal, reversible accounting selector with legacy, shadow, and lineage modes; family-level containment; debug-only comparison diagnostics; cache keys scoped by accounting mode and schema; regression protections; and explicit rollback behavior.

Locked constraints

Do not add a user-facing preference unless upstream requests one. Default remains legacy until promotion approval, then changes to lineage while retaining legacy rollback. Contained families do not force whole-scan fallback and no family may contribute through both accounting paths.

[iam-brain]

Implemented in stacked PR #37. Legacy remains default; shadow and lineage use isolated mode/schema caches, lineage fails closed, and containment is family-scoped with logical siblings additive.