feat: enforce import provenance exposure policy (#2)

Merge BAT-017 / REQ-021 implementation after delivery-runner implementation, independent QC, and passing GitHub Actions CI.

jarca_ledger_mcp/kb_bank_pdf.py

@@ -1,13 +1,14 @@
 from __future__ import annotations
 
 import hashlib
-import json
 import re
 from dataclasses import dataclass
 from datetime import datetime
 from pathlib import Path
 from typing import Any
 
+from .provenance_policy import allowlisted_json_payload
+
 try:
     import fitz  # PyMuPDF
 except ImportError:  # pragma: no cover - exercised as runtime config error
@@ -55,7 +56,7 @@ class KbPdfTransaction:
         return hashlib.sha256(raw.encode("utf-8")).hexdigest()
 
     def raw_payload(self) -> str:
-        return json.dumps(
+        return allowlisted_json_payload(
             {
                 "page": self.page,
                 "transaction_datetime": self.transaction_datetime,
@@ -67,8 +68,7 @@ class KbPdfTransaction:
                 "remittance_memo": self.remittance_memo,
                 "branch": self.branch,
             },
-            ensure_ascii=False,
-            separators=(",", ":"),
+            allowed_keys=("page",),
         )