Extend transparency tiers to work jobs, attempts, deployments, and traces #149

Outcome

Every artifact an issue timeline links — an attempt, a work job, a deployment receipt, a trace — carries a transparency tier from #70, and the same viewer gets the same answer on the web page, the API, and an export.

This is stage 5 of #10 and the whole of Track E's E6. The design is docs/2026-08-23-issue-work-receipt-linkage-design.md, section 4.

Current behavior

#70 shipped the four tiers. OpenAgents.Transparency implements dark, pulse, ledger, and glass (lib/openagents/transparency.ex:19), effective_tier/2 clamps an artifact's tier to the viewer's own and resolves a revoked link to dark, and artifact_links stores the tier with a database check constraint.

The vocabulary does not cover work. ArtifactLink.artifact_types/0 is ~w(changelog release issue build) (lib/openagents/transparency/artifact_link.ex:15). There is no member for an attempt, a work job, a deployment receipt, or a trace, so nothing an issue timeline shows about agent work can carry a tier.

Stage 1 sidestepped this deliberately: its attempt projection carries only what the assignment already published as a public issue comment, so nothing was newly disclosed and no tier was needed. Anything richer needs this issue first.

Work

• Add attempt, work_job, deployment, and trace to ArtifactLink.artifact_types/0 and to the artifact_links check constraint.
• Attach a link to each edge stage 4 records, with the authority snapshot the link already stores.
• Route every issue-timeline and API read of a linked artifact through Transparency.allows?/3 rather than a per-surface rule.
• Keep repository and account authority stronger than any tier. A tier can only narrow what a reader who already passed Repositories.readable_by/2 sees.
• Support revocation without rewriting immutable receipts: remove access and leave the bounded tombstone Transparency.revoke/3 already produces.
• Let a public issue disclose that restricted evidence exists without revealing its content or its private source metadata.

Acceptance criteria

• The same viewer receives the same visibility result on the issue page, the /api/v3 response, and an export.
• A public issue can say that restricted evidence exists without naming a private repository, prompt, credential, or trace.
• Revoking a link removes access promptly and leaves an auditable tombstone.
• No tier can make a private repository or a credential public by implication.

Verification

Cover every tier and repository-visibility combination, revocation, export, and the owner and operator paths through effective_tier/2; mix precommit.

Dependencies

Stage 5 of #10. Builds on #70 (closed) and on stage 4 (#148). #69 and #71 both need it for their independent-artifact-visibility criteria. Track E, E6.