feat: add workload-authenticated result API

server/store/result_sql.go

@@ -51,6 +51,16 @@ WHERE player_id = ANY($1)
 ORDER BY player_id
 FOR UPDATE`
 
+type PostgresResults struct{ DB *sql.DB }
+
+func (r PostgresResults) SubmitResult(ctx context.Context, resultID string, result domain.MatchResult, binding domain.WorkloadBinding, payload []byte, now time.Time) error {
+	if r.DB == nil || resultID == "" || binding.ServerID == "" || binding.MatchID != result.MatchID || binding.ServerID != result.ServerID || len(payload) == 0 || now.IsZero() {
+		return fmt.Errorf("invalid result submission")
+	}
+	receipt := domain.ResultReceipt{ResultID: resultID, MatchID: result.MatchID, ResultNonce: result.ResultNonce, PayloadDigest: domain.ResultDigest(result), IntegrityState: result.IntegrityState, ReceivedAt: now}
+	return CompleteResult(ctx, r.DB, receipt, binding.ServerID, resultID, payload, now)
+}
+
 // CompleteResult is the durable receipt/reconciliation boundary. The caller
 // must have already authenticated the workload and computed the receipt
 // digest. Duplicate identical receipts continue the same completion path;