fix(P04): ship variant anchors to the grader prompt (MH#4 second clause — verifier P1)

GradingEngine takes an optional VariantStore (constructor DI); when the graded
task_id joins to a stored variant: the template's difficulty anchors render into
the grader user turn ("Expected effort envelope" — same bar for every variant of
the template, a-5) and the variant seed is stamped on the GradeRecord (D-029).
Lifespan reordered: VariantStore builds before the engine and is passed in.
Anchors context carries only template id + anchor numbers — D-028 learner-anonymity
preserved (leak tests keep holding). Plain engine (no store) stays variant-blind;
non-variant tasks grade without the envelope.

3 new tests: variant task -> anchors + seed present in prompt/record;
non-variant task -> no envelope; plain engine -> variant_seed None.
Suite 327 green; ruff clean.

---ci---
phase: 4
milestone: v0.3
status: verify
requirements: {covered: [REQ-3-005], partial: []}
---/ci---

apps/ai-service/ai_service/main.py

@@ -76,6 +76,30 @@ def create_app(settings: Settings | None = None) -> FastAPI:
         if getattr(app.state, "trace_integrity", None) is None:
             app.state.trace_integrity = TraceIntegrityMap()
 
+        # Variant generation (REQ-3-005): VariantStore from the same
+        # SQLite file as traces/grades (D-027), one VariantGenerator singleton
+        # wired through app.state — the generator receives store + provider
+        # via constructor DI and knows nothing of FastAPI (api/ composes it,
+        # same pattern as GradingEngine). Tests may pre-set
+        # app.state.variant_store / app.state.variant_generator (the same
+        # state-injection override); the lifespan adopts a pre-set store but
+        # NEVER rebuilds a pre-set generator (its provider binding is part
+        # of the test fixture).
+        # ORDER NOTE: built BEFORE the grading engine — the engine takes the
+        # variant store (Phase 4 MH#4: variant anchors ship to the grader
+        # prompt; variant_seed stamped on graded records).
+        variant_store = getattr(app.state, "variant_store", None)
+        if variant_store is None:
+            settings.db_path.parent.mkdir(parents=True, exist_ok=True)
+            variant_store = SQLiteVariantStore(db_path=settings.db_path)
+            app.state.variant_store = variant_store
+        if getattr(app.state, "variant_generator", None) is None:
+            app.state.variant_generator = VariantGenerator(
+                variant_store,
+                app.state.provider,
+                model=settings.model,
+            )
+
         # Grading persistence + engine (REQ-3-004): GradeStore from the same
         # SQLite file as traces (D-027), one GradingEngine singleton wired
         # through app.state — the engine receives its stores via constructor
@@ -95,27 +119,7 @@ def create_app(settings: Settings | None = None) -> FastAPI:
                 app.state.trace_integrity,
                 app.state.provider,
                 model=settings.model,
-            )
-
-        # Variant generation (REQ-3-005, Wave 3): VariantStore from the same
-        # SQLite file as traces/grades (D-027), one VariantGenerator singleton
-        # wired through app.state — the generator receives store + provider
-        # via constructor DI and knows nothing of FastAPI (api/ composes it,
-        # same pattern as GradingEngine). Tests may pre-set
-        # app.state.variant_store / app.state.variant_generator (the same
-        # state-injection override); the lifespan adopts a pre-set store but
-        # NEVER rebuilds a pre-set generator (its provider binding is part
-        # of the test fixture).
-        variant_store = getattr(app.state, "variant_store", None)
-        if variant_store is None:
-            settings.db_path.parent.mkdir(parents=True, exist_ok=True)
-            variant_store = SQLiteVariantStore(db_path=settings.db_path)
-            app.state.variant_store = variant_store
-        if getattr(app.state, "variant_generator", None) is None:
-            app.state.variant_generator = VariantGenerator(
-                variant_store,
-                app.state.provider,
-                model=settings.model,
+                variant_store=variant_store,  # MH#4: anchors + seed (D-029)
             )
 
         async def _reaper_loop() -> None: