[API integrity] Enforce accepted durable-job status URL invariant

[seonghobae]

Defect

Protected develop@942d164ceb7af497bb28a95f842db96429d1bdc4 documents EtlJobAcceptedResponse.statusUrl as a relative status-monitor resource URL, but the record constructor currently enforces only non-null. It accepts blank strings and arbitrary absolute/external URLs, so the immutable API model can represent states that violate its own RFC 9110-facing contract even though the current controller constructs a safe relative path.

This is a bounded internal API-integrity defect rather than a claim of an externally exploitable redirect in the current controller.

Required TDD repair

1. Add focused deterministic tests at the EtlJobAcceptedResponse constructor boundary that first prove protected source accepts invalid blank/absolute URLs.
2. Narrowly reject blank values and require an origin-relative status path. Preserve the valid /api/etl/jobs/{uuid} representation and existing null semantics unless the focused contract requires a more specific exception.
3. Keep the change path-disjoint from the active durable-failure lifecycle writer (fix(etl): bind durable job failure metadata to lifecycle #271), which currently owns EtlJobModelTest/snapshot/status-response work. Prefer a dedicated focused test class rather than racing that file.
4. Run focused and applicable full hosted validation, including non-vacuous exact coverage on the exact head.
5. Treat checks/reviews from predecessor or concurrent heads as non-transferable.

Acceptance

• Blank/whitespace-only statusUrl is rejected.
• Absolute or authority-bearing URLs are rejected.
• A valid origin-relative /api/etl/jobs/{uuid} URL is preserved byte-for-byte.
• Public Javadoc states the enforced invariant.
• Exact-head required CI/security/coverage gates pass before review/merge.

[seonghobae]

Integrated on protected develop by PR #273. Merge commit 8dbea18c97e5acab59fd84585e46c9639d1fe8cd is bounded to EtlJobAcceptedResponse and its focused status-URL regression test, enforcing non-blank origin-relative status monitor URLs while preserving the valid /api/etl/jobs/{uuid} contract. Closing as completed.