feat(ingest): adopt llm-ingestion-okf as Door A implementation (first consumer)

Replace the local 391-line ingest implementation with a thin adapter over
the shared llm-ingestion-okf library (git-pinned dae0bd1a via Forgejo,
tool.uv.sources). The materialize() signature is preserved; error types are
now the library's typed hierarchy rooted in IngestError, re-exported from
the consumer seam.

- tests/test_ingest_adoption.py: new load-bearing seam tests (delegation,
  offline invariant — allow_network is never passed, error contract),
  detach-proven red twice.
- Golden suites (file + sql) pass UNCHANGED — byte-exact behaviour proven
  against the repo-local fixtures.
- 6 test files migrated to the library error hierarchy; escaping/typed-cell
  unit tests dropped (byte-bound by the ingest-edge.md golden, unit-owned by
  the library's own 189-test suite). Provenance stamp now asserted
  independently from the §5 rule.
- mypy override follow_untyped_imports for llm_ingestion_okf (no py.typed
  upstream yet — reported as a finding).

Suite: 386 passed; ruff + format + mypy --strict clean; shared/, examples/,
runs/s10/ and run_s10.py byte-untouched.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/test_ingest_sql_loadbearing.py

@@ -17,14 +17,14 @@ sqlite fixture — no network, no credentials):
 
 from __future__ import annotations
 
+import hashlib
 import json
 from pathlib import Path
 
 import pytest
-from pydantic import ValidationError
 
 from portfolio_optimiser_claude import okf
-from portfolio_optimiser_claude.ingest import ManifestContract, load_manifest, materialize
+from portfolio_optimiser_claude.ingest import ManifestError, load_manifest, materialize
 
 GOLDEN = Path(__file__).resolve().parents[1] / "examples" / "ingest-golden-sql"
 CONNECTION_REF = "PORTEFOLJE_SQL_DSN"
@@ -34,6 +34,13 @@ _FIXTURE = GOLDEN / "fixture" / "portefolje.sqlite"
 _PROVENANCE_KEYS = ("source_system", "source_query", "ingested_at", "ingest_manifest", "generated")
 
 
+def _expected_stamp(manifest_path: Path) -> str:
+    # The §5 stamp rule, recomputed INDEPENDENTLY of the implementation:
+    # ``{manifest stem}@{sha256(raw bytes)[:16]}`` — RED if the stamping detaches.
+    digest = hashlib.sha256(manifest_path.read_bytes()).hexdigest()[:16]
+    return f"{manifest_path.stem}@{digest}"
+
+
 def _materialized(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> Path:
     monkeypatch.setenv(CONNECTION_REF, str(_FIXTURE))
     bundle = tmp_path / "bundle"
@@ -75,8 +82,7 @@ class TestProvenanceStamping:
         assert concept.frontmatter["source_system"] == "portefolje-db"
         assert concept.frontmatter["ingested_at"] == INGESTED_AT
         assert concept.frontmatter["generated"] == "true"
-        stamp = load_manifest(GOLDEN / "manifest.json").stamp
-        assert concept.frontmatter["ingest_manifest"] == stamp
+        assert concept.frontmatter["ingest_manifest"] == _expected_stamp(GOLDEN / "manifest.json")
 
 
 class TestNavigability:
@@ -112,21 +118,23 @@ class TestVerdictReservation:
             ],
         }
 
-    def test_verdict_okf_type_is_rejected(self) -> None:
-        with pytest.raises(ValidationError):
-            ManifestContract(**self._sql_manifest("verdict"))
+    def test_verdict_okf_type_is_rejected(self, tmp_path: Path) -> None:
+        manifest = tmp_path / "manifest.json"
+        manifest.write_text(json.dumps(self._sql_manifest("verdict")), encoding="utf-8")
+        with pytest.raises(ManifestError):
+            load_manifest(manifest)
 
     def test_rejection_is_fail_fast_before_the_db_is_opened(
         self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
     ) -> None:
-        # With the connection_ref env var UNSET, a run that got past validation would fail with a
-        # plain ValueError trying to open the db. Rejection is a ValidationError at validation —
-        # so the db is never opened (RED if the reservation stops firing first).
+        # With the connection_ref env var UNSET, a run that got past validation would fail
+        # as a SourceError resolving the reference. Rejection is a ManifestError at
+        # validation — so the db is never opened (RED if the reservation stops firing first).
         monkeypatch.delenv(CONNECTION_REF, raising=False)
         manifest = tmp_path / "manifest.json"
         manifest.write_text(json.dumps(self._sql_manifest("verdict")), encoding="utf-8")
         bundle = tmp_path / "bundle"
-        with pytest.raises(ValidationError):
+        with pytest.raises(ManifestError):
             materialize(manifest, bundle, INGESTED_AT)
         assert not bundle.exists() or not any(bundle.iterdir())