trinet: a coordinator restart pays the same (node, nonce) again -- durable journal, nonce mark, write before credit #906

At ea895b5, src/trinet:

• ledger.zig keeps the paid (node, nonce) set (spent_nonces) in memory only.
• mesh.zig:94 starts next_nonce at 1 on every start.

So after a coordinator restart the same (node, nonce) is credited again, and a receipt saved from an earlier run can match a reissued nonce. A credit also exists only in process memory, so a crash loses it, and nothing records whether the coordinator was run by the node's own owner.

Spec: gHashTag/t27#8426, PR gHashTag/t27#8427 (specs/trinet/node-work-credit.t27):

• the coordinator writes a nonce mark (blocks of 1024) before it issues past it, and resumes at the last mark after a restart, so a restart never reissues a nonce;
• one credit per (node, nonce), rebuilt from the journal on start; a credit counts only once its journal line is durable; an unreadable journal stops crediting;
• every credit line says its level: self_reported when the coordinator's operator is the node's owner (or unknown), verified otherwise.

Fix: src/trinet/journal.zig (append-only JSONL with fsync, restore, torn last line ignored, malformed line refused), Ledger.openJournal, Mesh.openJournal, write-before-credit in settle, a journal-backed freshNonce, and TRINET_JOURNAL / TRINET_OWNER / TRINET_OPERATOR in the CLI. Without a journal nothing changes.

Dmitrii Fedorov (@dmitrii-f-t27)