feat(coordinator): quorum verification for untrusted (volunteer) results

Replaces the C1 quarantine with real verification. Trusted results (lab token,
verified, or admin worker) are accepted directly as before. An untrusted
worker's result is recorded as one vote per (task, owner) in a new task_results
table; the task only completes once QUORUM_SIZE distinct owners submit the same
result hash, otherwise it returns to the queue for another independent compute.

- migration 0013 task_results (one vote per owner, quorum by result_sha256)
- CompleteTask branches on worker trust; unknown worker defaults trusted (safe:
  completing needs the lease, whose owner is always a known registered worker)
- claim drops the quarantine and excludes chunks the owner already voted on
- domain Task.ReleaseAfterVote; QUORUM_SIZE config (default 2)
- unit tests: trusted direct-complete, untrusted needs-quorum, can-claim

Reducer and job done/total logic untouched — still one completed task per chunk.

coordinator/migrations/0013_task_results.down.sql

@@ -0,0 +1,5 @@
+BEGIN;
+
+DROP TABLE IF EXISTS task_results;
+
+COMMIT;

coordinator/migrations/0013_task_results.up.sql

@@ -0,0 +1,23 @@
+BEGIN;
+
+-- Quorum votes for a task computed by untrusted (volunteer) workers. A trusted
+-- worker's result completes the task directly and never lands here; an untrusted
+-- result is recorded as one vote, and the task is only completed once enough
+-- distinct owners submit the same result_sha256.
+--
+-- One vote per (task, owner): a single volunteer cannot stuff the ballot by
+-- running many workers under one account. A resubmission updates their vote.
+CREATE TABLE task_results (
+    task_id            uuid        NOT NULL REFERENCES tasks(id) ON DELETE CASCADE,
+    owner_id           uuid        NOT NULL,
+    result_sha256      text        NOT NULL,
+    result_artifact_id uuid        NOT NULL REFERENCES artifacts(id) ON DELETE CASCADE,
+    created_at         timestamptz NOT NULL DEFAULT now(),
+
+    PRIMARY KEY (task_id, owner_id)
+);
+
+-- Quorum check groups a task's votes by result_sha256.
+CREATE INDEX ix_task_results_quorum ON task_results (task_id, result_sha256);
+
+COMMIT;