Verifier: late recheck for history-backed apps (provisional then final verdict) #1856

Fair test run 3: three of the five harms the verifier passed were late collateral, meaning changes that landed after the one-shot check. B had no late recheck on Medplum. The late-recheck ledger exists (#1669, #1834) but isn't wired up for FHIR.

Fix, generic:

• After the write, record a provisional verdict.
• After a quiet window W, compute the final verdict from the system's change history: a type-level _history?_since=t0 for FHIR, CDC or audit tables for SQL. Cover the touched records and any collateral in the declared scope.
• Set W per app at setup, from observed server behaviour in the sandbox, never from evaluation data.
• Consumers that need a final verdict wait for it. The ledger already models a recheck that is owed.

Tests: a real-app late-collateral fault on Medplum and on OpenEMR. The fault is caught at the final verdict, and the provisional verdict is marked not final.