fix(ledger): authorize run outcome correlation for linked callers #39

Hosted Security review on PR #32 identified that clientRequestId alone can correlate a terminal run to a ledger key. A restricted linked caller can therefore overwrite another item’s last-run metadata through a fenced thread, despite lacking ledger upsert access. Bind correlation to the authorized caller and ledger item while preserving the approved clientRequestId behavior for ordinary callers. Add a restricted-linked-caller regression proof. This is the P3 advisory at #32 (comment); no work status is changed by the current trigger.