Ledger: threshold signing, CRDT merge, and coordinator quorum

## Description

The ledger module has entry definitions, CRDT structure, and transparency anchoring, but the full multi-coordinator operation needs:

- Threshold signing with t-of-n coordinator signatures (currently single-node stub)
- CRDT OR-Map merge across coordinator replicas
- Cross-shard MerkleRoot computation every 10 minutes
- Donor-facing balance verification (`worldcompute donor credits --verify`)

## Requirements

- Implement t-of-n threshold signing (target: 3-of-5 for initial coordinator set)
- CRDT OR-Map: merge function, conflict resolution, eventual consistency
- MerkleRoot computation across all coordinator log heads
- Local O(log n) balance verification for donors
- Ledger replication via GossipSub
- RS(10,18) durability for ledger data

## Success Criteria

- [ ] Threshold signing works with 3-of-5 coordinator quorum
- [ ] CRDT merge produces consistent state across replicas
- [ ] MerkleRoot anchored to Rekor every 10 minutes
- [ ] `credits --verify` performs local cryptographic verification
- [ ] Integration test: multi-coordinator ledger operations
- [ ] `cargo test` passes

## Testing (Principle V)

- 5 coordinator nodes → sign entry → verify 3-of-5 threshold
- Partition coordinators → rejoin → verify CRDT merge consistency
- Verify MerkleRoot appears in Rekor within 10 minutes
- Run `credits --verify` → verify proof validates against published root