feat(coordinator): complete tasks with an artifact_id, not a URI (CTX-05, part 3)

Task results are now coordinator-owned artifacts end to end.

- domain.Task carries ResultArtifactID instead of ResultURI/ResultSHA256;
  CompleteWith and its idempotency key are keyed on the artifact id.
- CompleteTask verifies the referenced artifact was stored for this exact
  task (rule 10): a worker cannot finish task B with task A's artifact, nor
  name an id that isn't a partial_result. Mismatch → 409.
- POST /tasks/{id}/result takes {result:{artifact_id,...}}; ListResults and
  ResultManifest follow.
- migration 0004 drops result_uri/result_sha256 and requires a completed task
  to reference its result_artifact_id.
- smoke and requests.http exercise upload → complete-by-id → replay → conflict.

coordinator/internal/usecase/job.go

@@ -99,15 +99,14 @@ func (uc *ListResults) Execute(ctx context.Context, jobID uuid.UUID) ([]domain.R
 
 	manifests := make([]domain.ResultManifest, 0, len(tasks))
 	for _, t := range tasks {
-		if t.ResultURI == nil || t.ResultSHA256 == nil {
-			continue // a completed task always carries both; skip defensively
+		if t.ResultArtifactID == nil {
+			continue // a completed task always references its result; skip defensively
 		}
 		manifests = append(manifests, domain.ResultManifest{
-			TaskID:       t.ID,
-			ChunkIndex:   t.ChunkIndex,
-			ResultURI:    *t.ResultURI,
-			ResultSHA256: *t.ResultSHA256,
-			Metrics:      t.Metrics,
+			TaskID:           t.ID,
+			ChunkIndex:       t.ChunkIndex,
+			ResultArtifactID: *t.ResultArtifactID,
+			Metrics:          t.Metrics,
 		})
 	}
 	return manifests, nil