feat(marketplace): version-aware browse, duplicate and adopter update

[LWS49]

Summary

Puts the versioned content model from the base PR in front of course managers. Browsing, listing and question preview, and duplication all now read the current version's snapshot instead of the live source assessment, so what a manager sees in the marketplace is exactly what they get when they duplicate. A manager who owns a listing gets a "publish new version" action on the assessment page.

On the other side of the transaction, an adopter whose copy is behind now finds out. The assessment page carries a banner naming when their content was published and when the marketplace's current version was, and offers to replace the copy's content in place. That offer is withheld once a real student has submitted work, because replacing content would discard both their submission and any local edits, and the banner explains that instead of failing.

Finally, a system admin looking at the container course's assessment index gets a version chip per row, since every snapshot there keeps its origin's title verbatim and shares one tab.

Finally, a snapshot's own page now warns that it is frozen. A snapshot in the container is an ordinary assessment with Edit, Delete and the question menus all live, and editing one silently changes what future adopters copy for a version that was never published. Nothing is disabled - the surface is admin-only and the escape hatch for repairing served content is deliberate - so the banner names the risk and links straight at the source assessment to edit instead.

Design decisions

• The banner dates both content vintages rather than numbering them, and cannot be dismissed or muted - it is a statement of fact about the copy, so it stands until the copy is updated or deleted. Date precision escalates to include a time only when the two vintages would otherwise render identically, which happens when a listing is republished twice in one day.

• The in-place update replaces questions and materials but deliberately leaves published and the destination tab alone, so updating cannot silently expose, hide or relocate an assessment. Unlock conditions and link-tree membership are also untouched, for a stronger reason: they reference the adopting course's own objects, so the snapshot's would be meaningless there.

• A colliding title is renamed on every import, not only on re-import of the same listing, and the suffix carries the content's vintage read from the same field the banner uses so the two can never disagree. A copy landing on top of an unrelated assessment of the same name collides just as badly and previously landed silently.

• Marketplace abilities take the listing as their subject rather than the assessment, because the assessment these actions serve is the container snapshot and never the authoring copy, and because keying on the listing keeps the check working for an orphaned listing whose authoring assessment is gone.

• The snapshot warning is a soft guard, banner only. A hard guard would need an ability rule in the PR below this one, and it would permanently remove the ability to repair served content without minting a version. The trigger is marketplaceVersion present with a non-null publishedAt, the same discriminator the version chip already uses to label the working copy, so the two cannot disagree.

• The source-assessment link is absolute and carries the origin instance's own host and port, because a course id only resolves on its own instance's host and a controller otherwise supplies the port the request reached Rails on rather than the public one.

Regression prevention

Covers: browse, listing preview and question preview reading the snapshot rather than the live source, including that a published listing with no snapshot cannot break the browse page; publishing a new version from the assessment page; duplication producing the snapshot's content, the dated rename on collision, repeated re-imports not compounding the suffix, and title truncation against the column limit; the adopter payload emitting the notice only when a newer version exists; the in-place update service preserving publication state, tab, unlock conditions and link-tree membership while deleting test submissions; the gate that withholds the update once a non-phantom student has submitted, enforced at the endpoint and not only in the payload; conditional datetime precision on the banner; and the container index badge, including that it stays off ordinary courses and away from non-admin previewers.

Also covers the snapshot warning: it renders for a published snapshot with a working source link, explains the absence instead of linking when the listing is orphaned, and stays off both the listing's working copy and any assessment the marketplace does not own. The payload side asserts the link resolves on the origin instance's host for a cross-instance source, which is what catches a missing tenant escape or a missing explicit port.

Manually verified: editing a source after publishing leaves the marketplace serving the old snapshot until a new version is cut; duplication matches the served snapshot and a re-import gets a dated title; the banner appears on a copy that is behind and the update preserves deadlines and publication state; a copy with a real student submission shows the explanation and no action; the container index shows dated chips on snapshots and "Source Assessment" on the working copy.

Backward compatible for adopters. Existing copies gain a banner only once their listing publishes a version newer than the one they hold.

[LWS49]

Follow-up, deliberately not in this PR: host_options and the source-assessment URL build now exist in both Course::Assessment::AssessmentsController and System::Admin::MarketplaceListingsController. They are duplicated because the admin controller lands in #8526, above this PR, so sharing would mean an upward dependency. Extract to a shared concern once the stack merges.