fix(tests): the validation ledger writer refuses a ledger its own verify rejects

`tests/test_ownir_validation_fixtures.py --write` exited 0 after writing a
ledger that the very next verify run rejected. The trigger is any change of
`OWNIR_VERSION`: 207 controls spelled the version as the literal `0`, so once
the constant moves every one of them is refused at the version gate before the
rule it exists to exercise can run. 58 acceptance controls flip to rejections
and the writer commits the result (accepted: 2 of 294).

- the controls say `OWNIR_VERSION`, not a literal; at version 0 the committed
  ledger is byte-identical, so no fixture moves
- a new control rebuilds the ledger with the version shifted on both sides
  (the controls and the strict door) and requires every verdict and category
  to hold
- the invariants live in one function shared by verify and `--write`, and the
  writer refuses to commit a ledger that fails them

Negative control: with the new controls and without the fixes, verify fails
with `FAIL[version-agnostic]: 58 control(s) change their verdict`.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: PhysShell