fix(batch-anchor): leaf scheduled envelopes over final signed R

[solloek369-arch]

Implements the ruling in #102: new scheduled envelopes are anchored over the final signed record R instead of the producer envelope E, in both modes.

Classification. A staged file is an envelope only when its top-level keys are exactly producer, trace, signature and trace is either a string or an object carrying its own signature. Everything else keeps whole-file anchoring in both modes, including direct TRACE records with a top-level trace member such as samples/example-trust-record.json.

Carrier. trace may carry R as its exact JSON text, the way aggregator/server.py takes as-transmitted claims. The producer signature over E covers that string, so the exact text is signed.

trace	sorted-key	as-transmitted
object with own signature	sorted-key bytes of R	rejected, no exact R text
exact JSON text of R	sorted-key bytes of parsed R	the string's UTF-8 bytes

No fallback to re-serialized R or to E. Text must parse to an object with unique member names and pass the existing anchor profile. A malformed R text fails the producer's group before anything is written, the same whole-group rule as a failed signature.

Unchanged. Flat and direct records, batch IDs (still over E), signature verification, and historical E-leaf entries, which remain evidence of E inclusion only. No inner-R signature verification is added.

Known non-goal. Entries do not record whether their leaf subject is E or R; canonicalization_id names the byte construction only. This change does not add such a marker.

Tests. 22 new tests pass; the complete batch module passes 53 tests. Selected repository regression: 377 passed; seven commit-producing tests were excluded. Four targeted mutants were killed: restoring E as subject, reserializing object-valued R, ignoring exact R text, and bypassing outer verification. Ruff passes.

Out of scope: agentrust-io/trace-spec#448 (finding 21).

Closes #102