feat: introduce Task Contract and Plan–Act–Evaluate artifacts

[arthurpanhku]

Goal

Start M1 with an inspectable, bounded execution contract and explicit Plan–Act–Evaluate artifacts for every production assessment.

Scope

• add immutable, versioned AgentTaskContract, PlanArtifact, and EvaluationArtifact schemas
• create and expose the contract through assessment create/get/list responses
• insert a deterministic read-only plan_assessment node before document context and drafting
• run independent deterministic evaluation after threat-evidence verification
• attach contract, plan, and evaluation artifacts to reports and task results
• preserve compatibility with existing custom assessment runners without executing them twice
• regenerate OpenAPI, assessment JSON Schema, and frontend API types

Safety boundary

This slice records high-risk tasks but does not yet enforce plan-first approval. Until that policy slice lands, all tasks keep the existing mandatory human-review boundary.

Validation

• Ruff: passed
• backend: 124 tests passed
• evals: 5 tests passed
• generated contracts: current
• frontend: 6 tests passed
• production dependency audit: 0 vulnerabilities
• production build: passed

Refs #35