ledger: diagnosable executor attribution via TDD_EXECUTOR_MODEL and Executor.reason

[geuben]

Summary

• Adds TDD_EXECUTOR_MODEL env var: harnesses that know the executor set this; recorded with source: declared, wins over transcript detection. Fixes subagent attribution (subagents inherit the parent's CLAUDE_CODE_SESSION_ID and would be mis-attributed; the launching harness now has an explicit override channel).
• Adds Executor.reason: records why detection fell back to unknown (session env not set; no transcript for the session; transcript has no model records) — the failure is diagnosable instead of silent.
• run start emits an executor_unknown integrity event and sets executor_warning in the success envelope when the source is unknown — the gap is visible at the moment it can still be fixed.
• tdd doctor reports an informational executor identity check (always ok: true) showing <source>: <model> plus the reason when unknown.
• Updated §5.1 of PRD.md and harness-integration.md to document the new resolution order and behaviour.

Commits

7274cf4 docs: friction log for issue-74-executor-attribution
e9e8bca docs: document TDD_EXECUTOR_MODEL, Executor.reason, executor_unknown in §5.1 and harness-integration
c658611 feat: informational executor identity check in doctor
241591a test: doctor names the executor-identity diagnosis
2d33e0d feat: executor_warning in the run start envelope
86541dc test: run start result warns when the executor is unknown
daf7f7f feat: run start logs executor_unknown with the detection reason
726ea02 test: an unattributed run leaves an executor_unknown event
34029594 feat: reason distinguishes a model-less transcript from a missing one
6764fa3 test: unknown executor carries the no-model-record reason
8e0a826 feat: reason names the session whose transcript was not found
cd3685c test: unknown executor carries the no-transcript reason
f648879 feat: Executor.reason — CLAUDE_CODE_SESSION_ID not set
603318a test: unknown executor carries the missing-env reason
369b18d refactor: the declared override wins over a readable transcript
1a2d640 feat: declared executor identity takes precedence
325b820 test: declared identity overrides transcript detection
6c60691 refactor: TDD_EXECUTOR_MODEL resolves with source declared
63a3fa8 feat: harness-declared executor identity via TDD_EXECUTOR_MODEL
dffa231 test: TDD_EXECUTOR_MODEL yields source declared

Quality gates

• uv run ruff check src tests — passed
• uv run pytest tests/ — 426 passed

Test coverage note

All decision-point operators in new code are covered by at least one test (pseudo-mutation analysis passed).

Closes #74