fix(candidate): bind exact task instruction bytes

[drewstone]

What

• replace the ambiguous task input digest with an explicit UTF-8 instruction identity
• require the exact SHA-256 digest and positive byte length of the agent-visible instruction
• bind delivery to one final argv value, exact stdin followed by EOF, or the fixed /tangle/input/task.txt path and TANGLE_CANDIDATE_TASK_PATH environment name
• keep file delivery outside both task and candidate workspaces and reserve the evaluator-owned environment variable
• keep the release unpublished until the corrected execution contract lands

Why

The prior field did not define which bytes were hashed or how those bytes reached the launched process, so two runtimes could produce the same-shaped plan for different task instructions or delivery behavior.

Verification

• pnpm build (8 packages)
• pnpm check-types (8 packages)
• pnpm test (523 tests)
• git diff --check
• git merge-tree --write-tree origin/main HEAD