feat(coordinator): worker trust tiers (C1) — enroll volunteers, quarantine untrusted

- migration 0012: workers.owner_id + trust_level (trusted/untrusted)
- verifier/authctx read the JWT verified claim; IsTrusted() = admin||verified
- /workers/register resolves trust from auth: service token or verified/admin
  JWT -> trusted; plain user JWT -> untrusted, tagged with owner_id
- claim quarantines untrusted workers (no tasks) until quorum (C2) lands
- unit tests for trust resolution, quarantine, and the verified claim

Additive and backward compatible: shared-token workers stay trusted, so the
existing worker flow and team tests are unchanged. Quorum verification (C2)
is deferred.

coordinator/internal/usecase/task.go

@@ -51,6 +51,13 @@ func (uc *ClaimTask) Execute(ctx context.Context, in ClaimTaskInput) (*domain.Cl
 		if err != nil {
 			return nil, err
 		}
+		// C1 quarantine: an untrusted volunteer worker may register but receives
+		// no tasks, because there is not yet (until quorum, C2) any way to verify
+		// its results. Report an empty queue rather than an error, so its poller
+		// simply idles.
+		if worker.TrustLevel == domain.WorkerUntrusted {
+			return nil, nil
+		}
 		// Never trust caller-supplied capabilities: registration is the durable
 		// worker identity and its allowlist.
 		workloads = worker.Capabilities