feat(werkbank): make the loop runnable — enqueue + artifact serve/fetch (WB-05b)

Closes the gap between "endpoints exist" and "a runner can actually run a job":

- POST /api/v1/werkbank/jobs/enqueue {tenant, target_id} — the control-plane
  "enqueue" half: extract the target's control-logic program, stash the source as
  a content-addressed blob, and queue a plc-provision job referencing it by hash.
- GET /api/v1/werkbank/artifacts/{hash} — serve a blob so the runner can fetch
  the program (traversal-safe: the hash is validated). Both runner-token gated.
- blob.rs: store_bytes / read_blob helpers; ingest::blob is now pub(crate).
- .env.example documents WERKBANK_RUNNER_TOKEN.

With the runner-side auth + blob fetch (werkbank repo), the loop runs end to end:
enqueue -> lease -> Docker executor fetches the program by hash, provisions,
probes, DASTs -> completes -> findings persisted against the target.

Tests: a new integration test enqueues from a PlcSps target, confirms the job
carries a program blob, and serves it back. All 4 werkbank_api tests pass; clippy
+ fmt clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.env.example

@@ -47,6 +47,11 @@ PLC_RUNTIME_MAX_LIFETIME_SECS=180
 PLC_RUNTIME_OPENPLC_USER=openplc
 PLC_RUNTIME_OPENPLC_PASSWORD=openplc
 
+# Werkbank runner API (/api/v1/werkbank/jobs/*, /api/v1/werkbank/artifacts/*).
+# When set, mounts the runner-facing queue + artifact endpoints behind this
+# bearer token; runners present the same token. Unset = endpoints not mounted.
+WERKBANK_RUNNER_TOKEN=
+
 # Dashboard
 DASHBOARD_PORT=8080
 AGENT_API_URL=http://localhost:3001