rework gradient build as Build Requests (#234)

[DerDennisOP]

Closes #234.

Summary

• Replaces the parallel direct_build ownership graph with a per-org build-request project (reserved name, server-managed, no settings UI). Lazy creation on first dispatch.
• Rewrites gradient build as a nix-free git-files diff upload (BLAKE3 content-addressed blobs, three-step manifest → blobs → dispatch flow). No Nix tooling runs on the client.
• Server materialises /nix/store/<hash>-source in pure Rust via harmonia_store_core, writes the NAR through nar_storage, queues signature placeholders, and dispatches an evaluation through the existing project/commit/eval pipeline.
• gradient download rewritten as an artefact-tree picker over GET /evals/{id}/artefacts. Selection syntax supports indices, ranges, and all; works interactively or via --products.
• New org option hide_build_requests (DB column, backend PATCH, nix module option, frontend toggle, OpenAPI schema).
• Clean break: drops the direct_build table, the POST /builds route, the GET /builds/direct/recent route, the max_direct_build_size knob, and the eval/build access-context fallbacks.
• Scheduler GC: per-org build_request_blob sweep via existing nar_ttl_hours, and expired-undispatched upload_session sweep — both hooked into the existing cache cleanup tick.

Breaking changes

• Nix module: services.gradient.settings.maxDirectBuildSize is removed. Operators with that key set will need to drop it (no replacement; MAX_BUILD_REQUEST_SIZE is a 20 MiB constant).
• CLI: gradient build <derivation-path> is gone. gradient build now requires a git working tree and takes an optional [TARGET] attribute path. gradient download's --build-id flag is replaced by --evaluation + product picker.
• HTTP: POST /api/v1/builds and GET /api/v1/builds/direct/recent return 404.

Test plan

• CI runs the new integration tests: build_requests_manifest, build_requests_blobs, build_requests_dispatch, evals_artefacts, old_direct_build_gone.
• CI runs the new cleanup sweeps: build_request_blob_sweep_evicts_stale, build_request_blob_sweep_disabled_when_ttl_zero, upload_session_sweep_deletes_expired_undispatched.
• CI runs materialise_source_nar unit tests (deterministic hash, -source suffix, base32 shape).
• Manual: gradient build end-to-end against a dev server using a tracked git repo, verify the eval queues and logs stream.
• Manual: gradient download picker walks the artefact tree on a completed eval.
• Manual: frontend hides the build-request project's Settings tab and the project-create form rejects the reserved name.
• Manual: org settings "Hide Build Requests project" toggle round-trips through PATCH and is reflected in subsequent fetches.