Artifact consent is pinned to the exact action and slug that were approved

Approved artifact tool inputs now carry a hidden __artifactConsentPin property recording the approved {action, slug}. Execution re-reads that pin and only performs the privileged step when it matches the action and slug actually being run, throwing asset_target_changed if the approved target no longer matches. A sibling-tag check also rejects inputs carrying any of the other four consent tags. This closes a hole where a target could be swapped after approval for list_assets, read_page_data, watch, read_db, and write_db. This applies to everyone.