feat(capture): Ghi paste, truthful import evidence and ledger trust

[Thunderkill016]

Scope

Owner-approved combined release of paste inside Ghi, truthful import explanations,
fail-closed ledger-trust reads and independent financial invariant regressions.
Canon Stage 0/1; no provider connectivity, SQL, RLS, dependencies, secrets or Auth changes.

• Reuse one paste form in dashboard, transactions, quick capture and standalone paste.
• Preserve manual/paste drafts and focus; block mode switching/dismissal during work.
• Paste creates pending Inbox candidates only, never automatically posts ledger facts.
• Explain distinguishes recorded/default parser evidence, actual rules and matching basis.
• Reject impossible review dates; withhold inconsistent ledger-trust payloads.
• Correct calendar fragments being parsed as money; preserve offsets and signed/decimal VND.
• New paste provenance is paste_text@1.2; recorded historical versions stay unchanged.

Evidence and limits

• Four parser regression tests; focused parser/provenance/map/review: 81/81 pass.
• Full unit: 2000/2000; CI-policy: 191/191; clean typecheck/ESLint/static contracts.
• Combined desktop/phone smoke: 44/44, with all six Ghi cases after the final parser
  correction. Hosted final-head smoke is required for exact complete-snapshot proof.
• Added embedded-paste date/money, focus, preview-only action and Escape regression
  to the critical-browser matrix (WebKit/dark). Selected local audit: 86 cases running.
• Per-PR provenance: docs/research/pr-memory/2026/Q4/PR-759.md.
• Initial combined browser run found the calendar/money defect: 26 pass, 3 fail,
  1 interrupted, 14 not run. It is not accepted or relabeled as a flaky retry.
• Local authenticated trust evidence uses a loopback Supabase double, not real DB/RLS.
• No dedicated repository formatter is configured; existing ESLint autofix is used,
  without adding formatting dependencies or changing repository tooling.

Authority / rollback

Owner explicitly approved commit/push/PR → exact-head checks → squash merge → main
production deployment (2026-10-05). No CI bypass, preview deployment, protection,
DB, secrets, Auth or production financial-data writes. Retain the ready base-main
deployment at aa67d59ca530430f813ccd4f9753d7d8dfd826fc; any provider rollback
requires its separate approval. Verify exact deployment/health and read-only routes.

Packets: docs/plans/active/2026-10-05-import-trust-invariants.md and the bounded
paste-inside-Ghi section of docs/plans/active/capture-v2-low-maintenance-acquisition.md.

[Thunderkill016]

Local evaluation completed on the corrected release: focused domain 81/81, full unit 2000/2000, CI-policy 191/191; clean final typecheck/lint/static contracts. Combined demo browser smoke 44/44, including all six Ghi hosts after the parser correction. Selected production-build UI audit: 85 pass, 1 intentional dark-preference skip, 0 retry; includes WebKit embedded-paste date/money/focus/Escape. Final hosted head is cfe97cf; remaining browser/complete UI-matrix checks must finish before the approved squash merge. PR database gate is policy-not-applicable, not real DB acceptance; main post-merge CI will force the full gate set. No production ledger or Auth mutation is authorized.