fix(decision): export receipts appended by hook processes

[TeoSlayer]

What changed

• refresh the append-only receipt journal incrementally before each export pass
• discover signed receipts written by separate managed hook processes without rescanning historical records
• fail closed on truncation, symlink replacement, incomplete records, and conflicting receipt IDs
• add a regression test with separate writer/exporter journal instances

Production failure reproduced

The long-running daemon opened an empty journal at startup. Later pilotctl enterprise hook processes appended signed receipts to the same file, but the daemon exporter only read its stale in-memory snapshot. Enforcement and local durability worked; hosted Evidence stayed empty.

Validation

• go test -race ./decision -run "TestReceipt(Exporter|Journal)" -count=20
• go test ./...
• go vet ./...

[codecov]

Codecov Report

❌ Patch coverage is 81.81818% with 8 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
decision/receipt_journal.go	80.95%	4 Missing and 4 partials ⚠️

📢 Thoughts on this report? Let us know!