Expose the qualification-only recipe API surface

[dovvnloading]

Summary

This PR completes the next documented Phase 2 slice: it exposes the durable fixed-function image recipe through an explicit qualification-only request surface and binds the coordinator to an injected worker-attempt factory.

What changed

• Added POST /api/v1/execution/recipe/image with strict request/acceptance schemas.
  • Accepts only an opaque owner-scoped artifact ID, a canonical typed image plan, and bounded retention.
  • Derives ownership from the authenticated installation principal.
  • Returns stable 404/409/422 responses without leaking paths, runtime details, or foreign-artifact existence.
• Kept the recipe route unavailable unless the app has a ready profile="qualification" lifecycle.
• Kept the deterministic fake.v1 preview route isolated from recipe coordinators while allowing the shared status/task/cancel/SSE surface to serve qualified recipe jobs.
• Added build_recipe_coordinator_factory, which wires an already-qualified worker-attempt factory to the lifecycle-owned repository without creating a process, binding a broker, loading a provider, or falling back to host execution.
• Added the generated OpenAPI/TypeScript contracts and CortexApi.startRecipeImageTransform().
• Added adversarial API/lifecycle/frontend tests and updated the Phase 2 ADR/evidence trail.

Safety and scope

Attachment staging remains a separate trusted boundary: this route consumes a pre-staged opaque artifact ID and does not accept file paths, uploads, commands, model/provider authority, or arbitrary code. The normal Cortex application remains default-off; no signing key, external review, or production trust material is introduced.

Verification

• Python: 329 passed, 1 skipped
• Focused recipe API/lifecycle set: 22 passed
• Frontend: 40 passed
• Frontend lint, typecheck, and production build: passed
• Generated contracts: refreshed
• Compileall and focused Ruff checks: passed
• git diff --check: passed

Next planned slice

Trusted attachment staging and binding the real signed/native broker worker into the injected attempt factory, with the same lifecycle gate and default-off behavior preserved.