fix(ledger): normalize every load rejection to ValueError at the ledger's own entrance

SavingsLedger.load unpacked the payload with `**`, so a valid-JSON but
non-object book ([], "x", 3, null) escaped as a raw TypeError — a failure mode
no caller catching ValueError would see. The run path was already covered:
valuereport.load_ledger caught the TypeError and re-raised it as ValueError,
and `run.py --goals` goes through that function. The leak reached only callers
outside that one path, which is why the suite stayed green.

The fix moves the normalization DOWN into ledger.py, where the public boundary
is, and deletes the now-dead patch in valuereport.load_ledger. One except
clause now covers the whole boundary: unparsable bytes (JSONDecodeError),
non-object top level (explicit check), wrong-shaped object (ValidationError).

Load-bearing (§11): the new TestLoadHasOneFailureType went RED before the fix
with exactly the TypeError it exists to forbid — pytest.raises(ValueError) does
not swallow it. Detach point named in the class docstring: drop the isinstance
check and the array/string cases raise TypeError again.

Found by cross-checking MAF's 7dab2df; queued in STATE as post 2b, approved by
the operator this session. 604 -> 612 passed, ruff + mypy --strict clean.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MQu2xxwedckjU56byu1aUG

src/portfolio_optimiser_claude/ledger.py

@@ -138,8 +138,21 @@ class SavingsLedger:
 
     @classmethod
     def load(cls, path: Path) -> SavingsLedger:
-        """Load a persisted ledger, schema-validated fail-fast (§10-style)."""
-        parsed = _LedgerFile(**json.loads(path.read_text(encoding="utf-8")))
+        """Load a persisted ledger, schema-validated fail-fast (§10-style).
+
+        ONE failure type for the whole boundary: unparsable bytes, a non-object
+        top level (an array or a bare string would otherwise surface as a raw
+        ``TypeError`` from ``**``) and a wrong-shaped object all raise
+        ``ValueError``. The normalization lives HERE, at the public entrance,
+        not in one caller — a book is refused the same way whoever opens it.
+        """
+        payload = json.loads(path.read_text(encoding="utf-8"))
+        if not isinstance(payload, dict):
+            raise ValueError(
+                f"ledger {path} is not a JSON object: top level is "
+                f"{type(payload).__name__} — a book is an object with 'entries'"
+            )
+        parsed = _LedgerFile(**payload)
         ledger = cls()
         for entry in parsed.entries:
             ledger._entries.setdefault(entry.key, entry)