fix(api): reject client-supplied workflow state

[Anthony Cintron (prbatero)]

Summary

Protect workflow-owned image-layer and inference state at the HTTP boundary so clients cannot inject generated artifact URLs, progress, or status values.

Changes

• Define reusable server-managed field rules for image layers and inference launches.
• Reject protected fields on creates and reject changed protected values on edits.
• Preserve omitted or unchanged stored workflow state during legitimate layer edits.
• Add route and utility regressions for create, update, and inference behavior.

Testing

• 46 API and request-field tests passed.
• Black, isort, flake8, and detect-secrets passed.

Review Notes

This PR is independent of the five-part project layer-loading performance stack and can merge directly into main.

[github-actions]

RC artifacts ready

All branch deployment references use the same RC tag:

• hastegeo_version: 1.0.40rc1
• training_image_tag: 1.0.40rc1
• imageprep_image_tag: 1.0.40rc1
• wheel: hastegeo-1.0.40rc1-py3-none-any.whl