Reject malformed ledger amounts before mutation

Description

The pitch.

## Summary

- Enforce the declared integer-cent domain at every current ledger entry boundary.
- Allow non-negative account-opening balances and require positive transfer and escrow-hold amounts.
- Reject booleans, floats, strings, integer subclasses, zero where disallowed, and negative values before balances, escrow, or trace events can change.

## Why

The current ledger accepts malformed amounts. A negative transfer or hold can move balances in the wrong direction while the generic conservation check still passes. This keeps the existing ledger model and fixes that current correctness gap.

The retained positive-amount invariant was surfaced while reviewing legacy PR #123 by @kishankannanblr-cell and legacy PR #7 by @mariagorskikh. This is a fresh implementation against current `main`; no contributor code was executed or copied.

## Scope boundary

This PR does not adopt AgentCourt, juror arbitration, persistent memory, HTLCs, hashlocks, timelocks, or a new payment policy. Those remain separate profile/design decisions.

## Verification

- `PYTHONPATH=$PWD/src .venv/bin/pytest -q tests/test_payments.py` — 31 passed
- `PYTHONPATH=$PWD/src .venv/bin/pytest -q` — 531 passed, 8 existing warnings
- Independent review: no critical, important, or minor findings