Add Statement Content Fingerprint

The chase/statements and usaa/statements retained histories churn on every re-download even when the owner-visible statement is unchanged. The statement PDFs are content-addressed by pdfsha256 = sha256(raw bytes), but the raw bytes are not the content: Chase statement PDFs are RC4-encrypted and the source regenerates the per-download encryption key material and embedded generation timestamps on every fetch, so pdfsha256 (and the pdfpath/documenturl that embed it) moves with zero change to the decrypted text or page count. Read-only evidence (tmp/workstreams/ri-version-rationality-evidence-v1-report.md) proved the decrypted text sha and page count are invariant across this churn for every comparable Chase blob pair, and that USAA's own PDF-derived transactions are byte-identical content across the same pdf_sha256 churn.

The reference stores current records in records and retained history in record_changes. Two PDF-statement streams — chase/statements (1 instance, 5 keys, 33 versions) and usaa/statements (1 instance, 15 keys, 101 versions) — retain large histories that are almost entirely acquisition noise.

The reference polyfill connectors that emit a PDF-statement stream (chase/statements and usaa/statements) SHALL emit, on each statement record, a positive owner-visible content fingerprint derived from the statement's content rather than from its raw bytes: