W03: Bind key delivery to the canonical release

[knzeng-e]

Scope\n\nImplement W03 from docs/backlog/implementation/W03-canonical-release-access.md.\n\n## Outcome\n\nA release cannot obtain another release's key or lose availability because an unrelated runtime reverts.\n\n## Acceptance\n\n- Bind chain ID, artist runtime, release identity, encrypted object identity, and key version across signed requests, policy checks, and key lookup.\n- Reject ambiguous duplicate content hashes without issuing a key.\n- Keep unrelated runtime failures bounded so an authoritative target release can still resolve.\n- Preserve Free zero-address verification and host-only protected room key delivery.\n- Add migration/compatibility evidence for existing hash-only requests and registered media.\n\n## Backlog\n\nBacklog doc: docs/backlog/implementation/W03-canonical-release-access.md\n