feat: verify ASTER compiled artifact references

[tuzuminami]

Closes #12

Summary

• formalize the versioned ASTER-to-DRIFT artifact reference contract
• require tenant-scoped verified resolution before scenario publish
• support async resolvers for in-memory and PostgreSQL-backed stores
• snapshot published graphs and context packs against post-publish mutation
• add schema, HTTP, security, and contract regression coverage

Verification

• npm run check (42 tests passed; PostgreSQL integration suite skipped without DRIFT_POSTGRES_TEST_URL)
• npm pack --dry-run --json

Review

• Sol reviewer and Sol security audit findings were addressed before this PR.