Phase 4: the runner uploads the log, so the server cannot write it

Phase 4: the runner uploads the log, so the server cannot write it

Streaming made the server the author of bytes the runner produced. Heartbeats
carried output chunks; the server concatenated them into a SQLite column and, at
finish, hashed the result itself with `LFS.PutBytes`. So the archived object's id was
the server's, not the writer's — the one output in the system that worked that way,
since artifacts are uploaded by the runner through put-object and pages/releases are
pushed by it. Nothing depended on it, which is why it was harmless; a signed run
record could never have bound it, which is why it had to go.

Streaming is dropped. At finish the runner uploads its log through the same
git-lfs-transfer path artifacts use, gets the object id the store computed from the
content, and names it in the finish message. The server's rule is the artifact rule:
the store is the authority on whether the bytes exist, and a claimed size that is not
the object's size is refused. Heartbeats now carry nothing but the lease.

A log is per attempt, not per run. A job that kills a runner is requeued, so one run
can have several logs, and the interesting one is usually the attempt that died:
`run_logs(run_id, attempt, oid, size)` replaces the single column, `AttemptLogs`
reads them oldest first, `/runs/<id>/log` serves the newest and `?attempt=N` picks
one, and `vole gc` treats every attempt's object as a root. Rows written before this
change still have their `log_oid`, which reads keep honouring; `Store.Log` and
`SetLogOID` are gone with the code that used them.

The cost, stated plainly: there is no live tail any more, and an attempt whose runner
was killed leaves no log at all — the attempt that hung is exactly the log somebody
wants. That is the trade: a log that can be shown to be the runner's is worth more
than one that arrives early. It also removes an unbounded text column from the queue,
which was growing into the WAL and every backup until a run finished.

Verified: TestCheckRunLogTrustsTheStore pins the new rule at the boundary (stored log
accepted, size mismatch refused, object absent refused, non-oid refused, no store
refused); TestLogsAreRecordedPerAttempt shows two attempts recorded separately,
`Get` returning the newest, both objects named for the sweep, and a finished run
refusing a log; TestHeartbeatAndFinishNeedTheLease now proves a stranger can neither
heartbeat, nor finish, nor record a log, and that a finished run carries no log text;
and the end-to-end test that runs the real binary now asserts the served log hashes
to the object id in the run row and that the queue kept no copy of it. scripts/ci.sh
green (gofmt, vet, build, markdown links, go test -race ./...).