Offline floor + local ledger + flush: floors apply when the gateway cannot see a call, and the history uploads on connect (0.16.0, #29 phase 1)

[davidcrowe]

Refs #29 (phase 1, additive). Gateway ingest side: davidcrowe/gatewaystack-connect#1115. Floor rules ported from gatewaystack-connect#1109.

What changes

Three states where the gateway does not see a call: no key (the on-ramp), key present but the gateway unreachable or rejecting the key (an outage), and --local policy mode. Before this PR the no-key path allowed everything with a warning and never ran a floor, and the unreachable path ran no floor either. Now, in all three:

1. The two floors apply. Hardline denies (unchanged rules). New ask-level destructive floor in decide.mjs: force push (not --force-with-lease), destructive SQL handed to a database client in any spelling (flag, positional, here-string, heredoc, piped literal), a remote download piped into a shell, recursive delete outside cwd / temp roots. Scans what will execute: heredoc bodies written to files and quoted prose cannot fire it. In --local mode the floor tightens a policy allow to ask; a policy deny still wins.
2. A local ledger (~/.acp/ledger.jsonl) records the call: id, ts, tool, classification, decision, reason, mode, session, cwd, bounded input preview. Size-capped (5 MB, oldest half dropped). Never blocks the hook. Nothing leaves the machine without a key.
3. Flush on the first governed call after a gap and at SessionStart with a key: a detached govern.mjs --flush child POSTs batches of 500 to /govern/ledger/flush, truncates on ack, writes a 5-minute backoff on failure, at most one spawn per minute. SessionStart prints one line saying how many buffered calls are uploading.

decide.mjs stays pure and import-free. The local policy engine is frozen, not removed (phase 2 is gated on flush data per #29).

Not changed

• Unattended tiers still fail closed on an outage (#385 posture); the deny is now also in the ledger.
• The gateway path is untouched except for the flush spawn before the call.
• Sibling harness plugins carry their own govern.mjs copies; they get this by the same port (coverage doctrine), tracked on Local mode → offline floor + local ledger + on-ramp (phase 1 additive now; phase 2 engine removal gated on flush data) #29.

Verification

• node --test test/: 180 pass (was 172). New: destructive-floor.test.mjs (unit, same fixtures as the gateway), offline-floor.test.mjs (real subprocess against a throwaway HOME: no-key, unreachable interactive + unattended, --flush against a local server, backoff, no-key sends nothing, SessionStart announce + detached flush).
• One existing fixture changed: the "no token warns once" test used a catastrophic command as its warn-only case; that command is now correctly denied, so the fixture is a benign command.

Release

Version 0.15.0 → 0.16.0 (govern.mjs, plugin.json, marketplace). Attestation baseline is per version, so the hash change lands cleanly (#888 lesson). acp-install embeds decide.mjs verbatim; sync after merge (#4).