feat: expose run artifact read contract

[chubes4]

Summary

• add a discoverable datamachine/get-run-artifacts ability with a versioned, normalized response
• enforce existing job ownership before projecting public artifacts or effective egress policy
• report canonical, legacy, or absent policy provenance without exposing engine data or storage rows
• cover unavailable discovery, missing jobs, authorization, empty and populated artifacts, malformed legacy policy, and provenance

Tests

• homeboy review lint --changed-since origin/main (PHPCS and PHPStan pass)
• homeboy review audit --profile architecture --changed-since origin/main (no introduced findings)
• php tests/cleanup-cluster-smoke.php
• php tests/run-artifact-egress-policy-smoke.php
• php tests/prefix-policy-audit.php

Environment Notes

• The host WP Codebox test runner stopped before PHPUnit execution because its cached CLI module is missing. The focused WordPress integration suite is included for CI.
• Full-repository lint and audit were run and report existing baseline findings outside the touched scope; changed-scope gates are clean.

Closes #3057