feat: lift worker transport evidence-verification rejection

[govindkavaturi-art]

Summary

Unblocks worker-transport cues from using evidence-based verification modes (`require_external_id`, `require_result_url`, `require_artifacts`).

Preconditions (both now met)

• cueapi-worker 0.3.0 published to PyPI — 2026-04-17 22:04:39 UTC. Handler writes evidence JSON to `$CUEAPI_OUTCOME_FILE`; daemon reads after exit, merges into outcome POST.
• cueapi-core feat: verification modes + evidence fields + transport combo rejection (hosted parity) #18 merged to main — verification_mode column + rule engine in place to read verification_mode and produce outcome_state transitions from evidence fields.

Changes

File	Change
`app/services/cue_service.py`	Remove `_check_transport_verification_combo` + its two call sites (in `create_cue` and `update_cue`). Replace with info-level logging when a worker cue is configured with an evidence-requiring mode.
`tests/test_transport_verification_combo.py`	Flip expected 400 → 201 on create, 400 → 200 on PATCH. Header comment documents history. Test class `TestWorkerEvidenceRejectedAtCreate` → `TestWorkerEvidenceAcceptedAtCreate`.
`README.md`	Update transport-compat footnote: all modes accepted; upgrade hint for users on cueapi-worker < 0.3.0.
`CHANGELOG.md`	Replace "### Restricted" entry with "### Removed" documenting the lift.

Test plan

• 13/13 pass locally in `test_transport_verification_combo.py` (flipped assertions)
• Full cueapi-core test suite via CI

Behavior change for end users

• Workers on cueapi-worker >= 0.3.0: can now combine worker transport with any verification mode. Handlers write evidence to `$CUEAPI_OUTCOME_FILE`.
• Workers on cueapi-worker < 0.3.0: evidence-requiring modes will land every execution in `verification_failed` because the daemon has no evidence channel. Operators should `pip install --upgrade cueapi-worker`.

🤖 Generated with Claude Code

[github-actions]

Parity check

This PR modifies files tracked in parity-manifest.json:

• app/services/cue_service.py

Please confirm one of the following in a reply or PR description update:

1. The equivalent change has been applied to the private cueapi monorepo. Link the PR.
2. This change is OSS-only and does not need porting. Briefly explain why (e.g. "fixes a bug that only exists in the OSS build").
3. A follow-up issue has been filed to port the reverse direction. Link the issue.

This is a soft check — it does not block merge. The goal is visibility, not friction. See HOSTED_ONLY.md for the open-core policy.

[argus-qa-ai]

Argus review — LGTM.

Preconditions confirmed met: cueapi-core #18 (verification_mode + rule engine) is on main, cueapi-worker 0.3.0 is on PyPI (2026-04-17).

Deletion is surgical — _check_transport_verification_combo, _EVIDENCE_REQUIRING_MODES, and _WORKER_COMPATIBLE_MODES fully removed with no orphaned callsites. Replaced with INFO-level logging breadcrumbs on both create and update paths — good for operators still on older workers. Tests correctly flipped from asserting 400 → 201/200 with history comment preserved. CHANGELOG and README accurate.

Minor note: in test assertion body['transport'] == 'worker' or body['callback']['transport'] == 'worker' — KeyError on the first branch would fall through to the second. Fine for test code, not a blocker.

All 5 CI checks green. Approved.