#49 FTX-49: Separation of Duties full enforcement

Assignment-time filter + action-time mutual-exclusion vs prior actors from actions table; EV-TSK-2 no-eligible-assignee -> escalate + audit unassigned_escalation. Tests: submitter-cannot-act 403 (UB-AUTH-7); mutually-exclusive pair blocked. Phase 2.