kernel: DatasetService — promotion from completed batches, mutation change log

[JArmandoAnaya]

Context

The Dataset is the mutable curated trunk of the project. Every mutation is logged — the
base of reproducibility and future enterprise auditing.

Deliverables

• promote(batch) — only from completed batches; adds annotated (non-skipped) assets +
  their annotations to dataset membership; idempotent.
• remove_asset(dataset, asset) — leaves membership; blob persists while any Release
  references it.
• Append-only change log: (timestamp, operation, subject ids, actor placeholder) for every
  mutation, queryable.

Acceptance criteria

• Promotion of a non-completed batch raises
• Skipped assets are not promoted
• Change log records every mutation and survives reopen

[JArmandoAnaya]

Done — PR #83, squash-merged as 57d502e. M1 is now 10/13.

Shipped: kernel/services/dataset_service.py, the seventh service and the one door into and out of a project's curated trunk. promote(batch_id) (gated on a completed batch, PROMOTABLE_PROGRESS = {annotated, accepted}, idempotent, batch-order membership), remove_asset(dataset_id, asset_id), assets, changes. Plus PROMOTABLE_PROGRESS in domain/task.py, DatasetOperation in domain/dataset.py, DatasetNotFound, and docs/datasets.md.

No migration — #3 already shipped dataset, dataset_member and dataset_change with their mappers, so FORMAT_VERSION stays 5.

Acceptance criteria: all three met, one test each — promoting a draft/approved/in_annotation batch raises BatchNotComplete; skipped assets stay out; the log records every mutation and survives a close and reopen with a timezone-aware timestamp. 32 tests in tests/kernel/test_dataset_service.py; full suite 461 passed, mypy/ruff/lint-imports clean.

Decisions worth not re-litigating:

• remove_asset has no confirm= — the second documented exemption in ConfirmationRequired's docstring, beside AnnotationService.delete. Nothing is destroyed and the log entry is what makes re-promoting an informed decision.
• A promote entry's subject_ids is the batch, then the assets it contributed, so the log answers where this came from without a column only one operation could fill. DatasetChange.operation stays str while DatasetOperation is what a writer picks from — a log must stay readable when it names an operation this build has never heard of.
• BatchNotComplete is reused, not duplicated, the way BatchNotInAnnotation already is across two services.
• Promotion is a union against current membership and has no memory of removals: re-promoting a batch does put back an asset a curator took out. Filtering promotions through the change log would make the audit record load-bearing for behaviour.
• Three shared lookups were promoted rather than copied a third time — BatchService.require_batch, the module-level jobs_of beside it, and ProjectService.require_dataset. JobService's byte-identical copies are gone. Net less duplication than before, and promote runs as one transaction.

Next: #12 — ReleaseService: immutable snapshots of the dataset, manifest pinned at creation.