feat: bind evidence and make assessment retries idempotent

[seonghobae]

Summary

• bind every evidence reference to its tenant-scoped learning registration
• add assessment-only idempotency keys with conflict detection for mismatched retries
• return the original evidence reference for an identical assessment retry
• extend the CI smoke path with same-key replay and one-row assertions
• update the data model, contract schema, product gap baseline, and changelog

Buyer-visible outcome

A provider can safely retry an assessment-result import without duplicating evidence, while a result cannot be reused across registrations or silently attached to a different external result. Completion decisions now query evidence only from the requested registration.

Evidence

• cargo fmt --all -- --check
• cargo test --workspace --all-targets --locked (6 passed)
• cargo clippy --workspace --all-targets --locked -- -D warnings
• RUSTDOCFLAGS=-Dwarnings cargo doc --workspace --no-deps --locked
• cargo build --bin lms_api --locked
• actionlint and JSON schema sanity check
• real PostgreSQL 18.4 temporary database: 15 RLS policies; identical retry returned the same ID; different source and different registration reused the key as 409; evidence rows were registration-bound; completion and credential revocation succeeded

Scope boundary

This remains a CWL-owned reference projection. A released Psychometrics Commons client/provider contract test, QTI conformance, assessment execution/scoring, audit/outbox, browser E2E, and production coverage/load evidence remain open.

Merge gate

This PR is stacked on PR #11. Review the exact current head and rerun required checks. No self-approval or protected-branch bypass is requested.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d0bd03f3-7cc9-45a6-9668-29a60135d6c1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-head review request for a1035e2: evidence is registration-bound and assessment imports are idempotent for identical retries, while mismatched source or registration reuse conflicts. Local Rust checks, schema/actionlint validation, and real PostgreSQL 18.4 evidence passed. Please independently review this exact head and rerun required checks; no approval or protected merge bypass is requested.

[seonghobae]

Current-head review request for 2ed7330. Re-verify the exact-head diff, required Checks, tenant/security boundaries, and any valid review findings after the shared Rust component-install fix. COMMENT only; no approval or protected-merge bypass is requested.