feat(work-items): ContextSnapshot routes (workitem/v1 follow-up to #349) #352

Follow-up to #349 (workitem/v1 store and routes).

docs/work-context-contract.md defines ContextSnapshot and two routes that #349 deliberately left out:

• GET|POST /api/v1/work-items/{id}/executions/{execution_id}/snapshots
• ContextSnapshot: id (cs_...), execution_id, seq unique per (work_item_id, execution_id), opaque snapshot_json with its own inner schema_version, content_hash, produced_by, created_at. Append-only: no route or store method updates or deletes a snapshot.

Acceptance criteria

• Store table + methods in internal/workitems, append-only, idempotent per (work_item_id, idempotency_key) like the other item mutations.
• Routes, OpenAPI, README. The service principal may append (contract "Identity and authorization").
• GET /api/v1/work-items/{id} gains the latest-snapshot pointer.
• Postgres-backed tests, including "no update/delete path exists" and seq uniqueness under concurrency.

Consumer: mctl-agents ContextSnapshot / ADR 011 (WorkContextRef).