WS-POL-001-03: Lock task and submission runtime to compiled policy context

[Abiorh001]

Parent: #29

Why

The roadmap says task readiness and submission creation must stop relying on transitional fields and lock to the guide source snapshot, effective submission artifact policy hash, and compiled project pre-submit checker bundle.

Roadmap Source

• docs/product_first_user_flows.md Flows 2 and 3
• docs/architecture_lockdown.md Task Contract
• docs/roadmap_day_by_day_execution_plan.md Day 3 and Day 5 exits
• WS-POL chunk map: WS-POL-001-03

Scope

• Add task locked-context references for guide source snapshot, effective policy hash, and pre-submit checker bundle hash.
• Block READY when locked policy context is missing or stale.
• Move submission pre-submit execution to the locked project PreSubmitCheckerPolicy.
• Prevent workers from providing checker names, severities, bundle versions, policy hashes, or outcomes.
• Preserve submission immutability and versioning.

Acceptance Criteria

• Task screening/ready tests prove missing locked context blocks release.
• Submission create tests prove pre-submit failures create no submission row, no new version, no submitted transition, and no submission-created audit event.
• Task/submission API responses expose the locked context needed by operators and reviewers without accepting it from workers.
• Week 1/Week 2 API drills are updated to use the policy-derived path.

Contributor Fit

Large backend task for a contributor paired with a maintainer. Strong proof-of-work value because it connects project setup to real worker intake.