Written inline after two headless workers died on API errors. Tests caught a
real cross-slice bug: ledger grants stored the full install ref as listing_id,
breaking GET /license/{op}/{listing} — fixed by parsing the listing prefix per
the ref convention in contracts/ledger-api.md. Also pinned the indexer test's
schema path (venv-installed package resolved outside the repo) — its earlier
pass was vacuous without jsonschema installed. 27 tests green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
