test(efficiency): make the ledger-agreement test hermetic

[HackPoint]

What

the_recorded_ledger_agrees_with_itself now asserts its invariants on a fixture ledger built in a temp dir with the production schema (connect_db), instead of reading the developer's own lumen.db. The body moved unchanged into assert_ledger_agrees(conn); the two swallowed-error unwrap_or queries now expect, and an empty ledger now fails rather than passing silently.

Why

On a clean main it failed on the maintainer's machine (565 of 2,547 eligible reads bypassed the optimizer, via the fail-open guards, per #30). That is a fact about one person's usage, not the code, and an always-red local test teaches people to ignore red.

Coverage

• Healthy fixture covers: saved = full - returned in both eras, clamped and signed losses, a builtin read recorded by two hooks (so the de-dup is load-bearing), and below-threshold / unmeasurable / uncovered-kind reads.
• One should_panic test per assertion (saving > file, clamp in signed era, negative in clamped era, losses swamping the headline, leak share, empty ledger) proves each guard can fail.
• Auditing the real ledger is opt-in: LUMEN_TEST_REAL_LEDGER=1 (prints a skip message otherwise). With it set on the maintainer's machine it still reproduces the original failure.

Not touched: the_recorded_savings_are_priced_and_their_provenance_is_known also reads the real ledger; it passes here, left out of scope.

Local CI (all green)

• cargo fmt --all --check
• cargo clippy --workspace --all-targets --exclude Lumen -- -D warnings
• cargo test -p lumen-core -p lumen-cli -p lumen-daemon -p lumen-mcp -p lumen-stats --all-targets --no-fail-fast

Closes #35