#166: Validate passive report attribution

[justsml]

Stacked on #164 / PR #150.

Closes #166

Scope

• Check target authorization before attribution so rejected requests do not become a project/thread/task enumeration oracle.
• Require same-project threads and tasks; task-only requests derive their stored thread.
• Require explicitly supplied thread IDs to match the task and target-bound tasks to match the requested target.
• Return one calm non-enumerating 404 for attribution failures.
• Carry a project-thread-task-target guard into Artifact persistence.
• Atomically validate attribution during the Artifact insert and hold SQLite/PostgreSQL transaction protection through object storage; PostgreSQL locks the relevant rows.
• Roll back database state and clean any written object if attribution changes during persistence.
• Keep indexing and project notifications post-commit.

Validation

• Public API integration covers missing/foreign threads and tasks, task-only derivation, explicit mismatch, wrong target, and valid attribution.
• A race regression mutates the task after initial validation and proves zero Artifact rows, object writes, indexing, or notifications.
• Stored API and Artifact service: 13 focused tests passed.
• pnpm typecheck, focused recon/test Biome, and git diff --check passed.

Merge order

Merge PR #150 first, then retarget this PR to PR #150's base or main.

[justsml]

Council of Dans review: repair/defer. Highest-priority gate: Do not hold database row locks across object-storage writes; stage storage, revalidate attribution transactionally, and clean up orphans on failure. Feature flags are not a substitute for authority, evidence-integrity, or durability fixes; use typed modes only where they provide a real rollout boundary.