feat(coordinator): complete tasks with an artifact_id, not a URI (CTX-05, part 3)

Task results are now coordinator-owned artifacts end to end.

- domain.Task carries ResultArtifactID instead of ResultURI/ResultSHA256;
  CompleteWith and its idempotency key are keyed on the artifact id.
- CompleteTask verifies the referenced artifact was stored for this exact
  task (rule 10): a worker cannot finish task B with task A's artifact, nor
  name an id that isn't a partial_result. Mismatch → 409.
- POST /tasks/{id}/result takes {result:{artifact_id,...}}; ListResults and
  ResultManifest follow.
- migration 0004 drops result_uri/result_sha256 and requires a completed task
  to reference its result_artifact_id.
- smoke and requests.http exercise upload → complete-by-id → replay → conflict.

docs/api-contract.md

@@ -19,7 +19,7 @@ must be updated in the same change as any behaviour it describes.
 | `POST /workers/register` | register + capabilities | ✅ done |
 | `POST /tasks/claim` | atomic lease | ✅ done |
 | `POST /tasks/{id}/heartbeat` | renew lease | ✅ done |
-| `POST /tasks/{id}/result` | complete | 🟡 done, but result is a URI today; moves to `artifact_id` next |
+| `POST /tasks/{id}/result` | complete | ✅ done, references `artifact_id` |
 | `POST /tasks/{id}/failure` | fail | ✅ done |
 | `GET /jobs/{id}` | progress | ✅ done |
 | `PUT /tasks/{id}/artifacts/{name}` | upload partial | ✅ done |
@@ -146,10 +146,10 @@ Content-Type: application/json
 }
 ```
 
-> **Transitional:** the coordinator currently accepts `result_uri` + `result_sha256`
-> instead of `result.artifact_id`. This switches to the artifact form in CTX-05,
-> once upload exists. Until then no worker-supplied `file://`/`worker://` URI is
-> valid in persisted metadata.
+The worker uploads its partial result first (§5.5), then completes with that
+`artifact_id`. The coordinator verifies the artifact was stored for this exact
+task before accepting it — a worker cannot complete one task with another task's
+artifact. No worker-supplied URI is ever persisted.
 
 ```http
 POST /tasks/{task_id}/failure