feat: add versioned assessment result references

[seonghobae]

Summary

• add assessment_result_reference/v1 JSON schema and a CWL-owned API boundary for Psychometrics Commons references
• persist only authority, opaque result reference, digest, source version, outcome status, and observation time
• enforce in Rust that only passed assessment evidence can produce a completion decision; failed/inconclusive evidence remains immutable but is rejected by the decision engine
• add PostgreSQL checks and real CI smoke coverage while preserving tenant RLS and external payload ownership
• update PRD/TRD/gap baseline, architecture, data model, doctoring, README, and changelog

Buyer-visible outcome

A Partner & Customer Academy can consume a versioned assessment result reference without copying psychometric responses or scoring payloads, and cannot issue a completion decision from a failed or inconclusive assessment.

Evidence

• cargo fmt --all -- --check
• cargo test --workspace --all-targets --locked (6 passed)
• cargo clippy --workspace --all-targets --locked -- -D warnings
• RUSTDOCFLAGS=-Dwarnings cargo doc --workspace --no-deps --locked
• cargo build --bin lms_api --locked
• actionlint and JSON schema sanity check
• real PostgreSQL 18.4 temporary database: 15 RLS policies; invalid contract 400; failed assessment completion 400; passed assessment completion 201; credential issue/revoke; rows 2 assessment references | 1 failed | 1 passed | completed | revoked

Standards boundary

QTI 3.0 is an interoperability target, not a conformance claim. Psychometrics Commons remains the authority for assessment administration/scoring; this contract is only the LMS reference projection.

Merge gate

This PR is stacked on PR #10. Review the exact current head and rerun required checks. No self-approval or protected-branch bypass is requested.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: bfae1caf-1d52-44f3-a3df-cb1d4574f50e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-head review request for 28358c2: the assessment reference contract is versioned, tenant-scoped, stores no external payload, and Rust rejects failed/inconclusive assessment evidence for completion. Local Rust checks, actionlint/schema validation, and real PostgreSQL 18.4 evidence passed. Please independently review this exact head and rerun required checks; no approval or protected merge bypass is requested.

[seonghobae]

Current-head review request for 7b69bdd. Re-verify the exact-head diff, required Checks, tenant/security boundaries, and any valid review findings after the shared Rust component-install fix. COMMENT only; no approval or protected-merge bypass is requested.