ledger: scheduled checkpoint anchoring — hourly or every 256 records, whichever first

[JSONbored]

Context

Sub-issue of #9267 (external decision-ledger anchoring). Ties #9272 (Rekor) and #9273 (git-commit) together into a scheduled job. Per the research on #9267: checkpoint cadence, not per-record — submitting an anchor for every decision record is wrong on every axis (Rekor is a donated public good; a git commit per PR review is noise; a naive per-record job also has no natural batching).

Requirements

1. Reuse the existing cron — wrangler.jsonc's */2 * * * * schedule, dispatched in src/index.ts. No new Cloudflare cron trigger.
2. Anchor hourly, skip if tipHash is unchanged since the last successful anchor — idempotent, free on quiet days.
3. Also anchor immediately once tipSeq has advanced by ≥256 since the last anchor, independent of the hourly clock — bounds the unanchored window by both time and record count, so a burst of activity doesn't sit unanchored for a full hour.
4. Both backends run per checkpoint (ledger: Rekor v2 hashedrekord anchoring backend #9272 and ledger: git-commit anchoring backend, cross-verified against GH Archive / Software Heritage #9273), each independently recording success or failure via ledger: anchor persistence + public attempt log (success and failure both visible) #9271 — one backend's failure must not block the other from attempting.
5. Never blocks a review. Anchoring is best-effort background work; a failure here must not affect any decision-record persist path, matching the existing fail-open posture of persistDecisionRecord's own ledger-append error handling.

Deliverables

• Scheduled anchoring job wired into the existing cron dispatch
• Tests: skip-if-unchanged, the ≥256-record forced-anchor trigger, both backends attempted independently, and that a total anchoring failure does not propagate to anything else

Expected outcome

~24 anchors/day worst case, and a wholesale ledger rewrite can only ever erase history back to the most recent anchor — at most one hour or 256 records, never the whole chain.

References

Sub-issue of #9267. Depends on #9270, #9271, #9272, #9273. Cron dispatch: src/index.ts:116, wrangler.jsonc:382.

[linear-code]

JSO-6437