feat: add per-party disclosure for enclave job logs and traceback frames

[pjwerneck]

Summary

The job runner writes stdout and stderr to a new staging folder, not to the review folder that the submitter reads. For an enclave job, the enclave moves an artifact to the review folder only when every data owner released that item.

Changes

• A new staging folder, at app_data/job/staging/<ds>/v<n>/<job>/. The runner writes stdout.txt and stderr.txt there. returncode.txt and outputs/ still go to the review folder. The submitter holds a read grant on the folder review/<ds>/, and every file under that folder inherits the grant. A write to the review folder is therefore the disclosure. The staging folder carries no grant.
• JobInfo.release_artifacts() and JobInfo.release_logs() move a staged file to the review folder. JobInfo.artifact_path() finds the file in either folder, so StdoutViewer, StderrViewer and the syft-bg stderr notifier still read a log that no party released.
• DisclosureItem names two items: logs and traceback_frames. approved_disclosures() returns the items that every party released. approve_job(job, disclosures) records the grant of one data owner. update_disclosures() changes that grant after the run, and _forward_new_releases() sends the artifact that a late grant covers.
• traceback_capture writes traceback_frames.json from the staged stderr. The record holds the file and the line of each frame, and the exception type. It never holds the exception message. Job execution does not change: there is no wrapper script and no new environment variable, and run.sh keeps its current form. A job submitted before this branch therefore also gets a record.

Testing

• 46 new tests in test_staging.py, test_traceback_capture.py and test_disclosures.py. test_full_job_lifecycle() and test_truncated_logs.py follow the new paths.
• uv run pytest packages/syft-job/tests packages/syft-enclave/tests/test_disclosures.py tests/unit/test_truncated_logs.py — 99 passed.
• uv run pytest packages/syft-enclave/tests/test_enclave_jobs.py packages/syft-rds/tests/test_job_auto_approval.py tests/unit/syft_bg/test_email_approve.py — 45 passed.
• test_no_sync_runs_while_an_ungranted_artifact_sits_in_review() watches the sync engine and checks that no gated file sits in the review folder at any sync. That test proves the gate, and not only the move.
• ruff check and ruff format report no problem. An old client reads a new approval file, because pydantic drops the extra disclosures key.

Asana task

https://app.asana.com/1/1185126988600652/project/1210542925864934/task/1217980407095932?focus=true