Pre-dispatch rejection ledger

Witness for MCP calls rejected pre-dispatch: hash-chained ledger, enum differ, signed receipts.