test: lock paper and shadow admission boundaries

[Pigbibi]

Summary

• add cross-boundary rejection coverage between paper admission and shadow input/ledger receipt
• require missing paper/shadow provenance fields to fail closed in tests
• cover scheduler receipt digest mismatch before shadow admission

Safety boundary

• offline contract/tests only; no provider, account, order, deployment, or configuration changes
• this PR does not grant E3/live permission and is not merged

Validation

• PYTHONPATH=src python3 -m pytest -q tests/test_paper_admission.py tests/test_shadow_receipt_store.py tests/test_shadow_ledger.py — 38 passed
• PYTHONPATH=src python3 -m pytest -q — 58 passed (baseline/full validation already run before the final bounded delivery step)
• PYTHONPATH=src python3 -m compileall -q src tests