fix: make Council payload digest independently verifiable

Wraps the signed Council body with its canonical SHA-256 so the public verifier can independently run the payload-digest check.

a11oy_ayllu.py

@@ -800,8 +800,7 @@ def register(app, ns: str = "a11oy") -> str:
         signer = _runtime_signer(request)
         nemo_route = _nemo_council_route(prompt, sign_fn=signer)
         contract = _build_council_contract(prompt, result, nemo_route)
-        receipt = _make_receipt({
-            "schema": "szl.ayllu.council-receipt/v2",
+        receipt_body = {
             "council_id": council_id,
             "prompt_sha256": hashlib.sha256(prompt.encode()).hexdigest(),
             "participants": result["participants"],
@@ -814,6 +813,11 @@ def register(app, ns: str = "a11oy") -> str:
             "nemo_route_receipt_sha256": _receipt_sha(
                 (contract.get("routing") or {}).get("receipt")),
             "human_checkpoint": contract["human_checkpoint"],
+        }
+        receipt = _make_receipt({
+            "schema": "szl.ayllu.council-receipt/v2",
+            "body": receipt_body,
+            "payload_digest": _sha256_json(receipt_body),
         }, sign_fn=signer)
         return JSONResponse({"council_id": council_id, "result": result,
                              "contract": contract, "receipt": receipt})