trigger-api: ledger the inbound-hooks mount + guard it (#11863) (#11885)

`ApiTriggerPlugin` mounts `POST /api/v1/automation/hooks/:flowName/:hookId`
straight on the host Hono app via `getRawApp()`, so the route is outside the
dispatcher ledger, outside `RestServer.getRoutes()`, and outside
`IHttpServer.getMountedRoutes()` by the contract's own words -- which is why
the #7526 live-mount parity gate cannot see it either. It carried no reviewed
disposition anywhere.

Adds the per-package ledger in the #3636 pattern (one row, `server-only`,
measured) and a conformance guard with three limbs: a real lifecycle drive
through a capturing host app, a source-side population scan so a second
registrar cannot hide behind a one-row census, and hygiene + anti-vacuity
assertions.


Claude-Session: https://claude.ai/code/session_01APWX2AwT3a4xDcjPCe8bk4

Co-authored-by: Claude <noreply@anthropic.com>

Author: claude[bot]