Receipt vault

Every governed run in every Studio in this org mirrors its signed receipt + audit line here. Local writes still happen — this is a shared destination on top, best-effort. Vault failure never blocks a run.