Persist confirmed workflow tasks with authenticated ownership and retries #2473

The Oct 23 UVAI review found that create_workflow_task returns success without durable storage. Hayden authorized starting the recommended next step on Oct 27.

Implementation scope: use existing Upstash REST storage configuration; derive ownership from verified session identity; require stable run IDs; preserve preview with zero writes; use an atomic idempotent write; require persisted readback before fulfillment; expose an owner-scoped read and task receipt; fail closed on unavailable storage.

Acceptance for this implementation issue: focused tests demonstrate one confirmation plus three concurrent retries produce one record and identical IDs; owner/run isolation, invalid input rejection, signed identity verification, preview gate and storage failure handling pass. PR #2472 implements this slice. Related #2469/#2470 cover a different local review-only journal.

Explicitly outside completion of this software issue: live provider/video quality, verified source timestamp/hash binding, hosted fresh-process readback, authenticated UI acceptance, usage/cost and production activation. The broader UVAI next-action acceptance remains open until those execution receipts exist. No merge or production permission is granted by this issue.