Trainees cannot view their own task signoff history in the web interface

[TusanHomichi]

Problem or outcome

task_signoffs::matrix is gated by lifecycle::may_read (the training-history read rule: assign_training, or view_assigned_records with an active assignment), so a trainee holding view_own_records cannot read the signoff state or history of their own enrollment, and the enrollment page's Task signoffs panel is never shown to them. The trainee packet (#48, ADR 0015) carries the full signoff history to the trainee, because a record about them that other readers can see but they cannot would make the packet incomplete by design. The interface should agree with the packet: a trainee should be able to see their own signoff state and history.

Scope

In scope:

• A read path for the trainee's own signoff matrix and history (view_own_records on their own enrollment), as a typed contract beside the existing training-history rule.
• A read-only presentation on the My records page (or a trainee view of their enrollment) showing current state per task and the override history with reasons and authority.
• Tests for the authorization line and the presentation.

Out of scope:

• Any trainee ability to record or contest a signoff; acknowledgment of signoffs is not modeled.

Acceptance criteria

• A trainee sees the current signoff state and full history for each task of their own enrollment, and nothing for other enrollments.
• Trainers and coordinators keep exactly today's access.
• The web interface shows the trainee their signoffs where they find their records.

Expected proof

• cargo test --workspace with the new authorization and read tests; web/ check, build, and an e2e step where the trainee reads their signoffs.

Related roadmap, decisions, or issues

• Raised while building Milestone 5 slice 2: trainee packets over the export units #48 (trainee packets); ADR 0015 records that the packet carries the signoff history and that this interface gap is tracked separately.
• ADR 0013 (task signoffs), Milestone 5 design: exports and recovery #44 (Milestone 5 design).