feat: add bilateral direct task assignment

[signerless]

Why

Arena 1v1 escrow cannot safely use the public claim or bid rail: an unrelated worker could otherwise claim or outbid the intended opponent.

Change

• add a direct-assignment task flag in existing reserved Task bytes (no account resize or migration)
• add create_direct_assignment_task for Exclusive, single-worker tasks
• reject public claims for those tasks
• add accept_direct_assignment_with_job_spec, requiring both creator and selected worker signatures
• bind acceptance to the exact job-spec hash/version and ExternalAttestation attestor
• reject referrer legs on this route because ExternalAttestation cannot distribute them

Verification

• cargo test --manifest-path programs/agenc-coordination/Cargo.toml --lib --offline (542 passed)
• cargo test --manifest-path programs/agenc-coordination/Cargo.toml --lib --no-default-features --features mainnet-canary --offline (326 passed)
• git diff --check

Follow-up

Anchor build could not run locally because crates.io timed out and the cache lacks rand 0.8.6; CI must generate and validate the SBF/IDL before any program upgrade. No mainnet program has been changed by this PR.