P2.1: address review — harden artifact validation, release/artifact fields
- validate_artifact: add empty content_type -> MissingField; size_bytes <= 0
-> new BadSize; sha256 not exactly 64 lowercase-hex -> new BadDigest (via
validate_sha256). The valid fixture (64-hex sha, positive size, non-empty
content_type) stays accepted.
- Release: rename updated_at -> published_at (published_at = 0 means draft).
Final order: id, app_id, version, build, channel, notes, created_by,
created_at, published_at.
- Artifact: add opaque metadata: string before validation_status.
- tests: add empty-content_type/MissingField, bad-size/BadSize,
malformed-sha256/BadDigest cases and contract pins reading back
Release.published_at and Artifact.metadata.
PO-ruled out of scope and NOT added: Token model, in-memory repository (P2.3).
85f9c7c487