Add opaque private-contract loader transport

[mark-e-deyoung]

Implements the public-safe transport required by agent-dispatch issue #2 without exposing private task content.

Changes:

• registers generic task private-contract-v1;
• accepts an optional opaque correlation workflow input;
• validates the correlation with the existing restricted identifier grammar;
• substitutes it only into the generic private-contract loader task;
• instructs Jules to read .agent/transport/<correlation>.json after cloning the authorized private target, then follow the private dispatch/task records;
• rejects correlation input for all other task IDs;
• keeps repository/branch mapping secret-backed and keeps public logs limited to opaque IDs/correlation values.

This PR contains no CY16 repository name, artifact identity, source URL, or private task text. The first intended workload is tracked privately.

Do not activate a new target mapping or normal-use transport until the repository-level hardening in issue #1 is verified.