Stage 6 backend: canonical report identity and run metadata

[anth-volk]

Fixes #3499

Summary

• make explicit report definitions canonical on API v1
• create/reuse reports by canonical report identity instead of the old thin sim/year/current-version rule
• resolve report reads through canonical parents plus display-run selection
• preserve explicit report specs across later PATCH/sync traffic
• preserve execution metadata from existing runs instead of rebuilding it from mutable parent rows
• validate aliases by canonical report identity
• add coverage for malformed legacy compatibility reads and identity/run-metadata behavior

Notes

• historical identity and alias backfill is handled separately on the updated stage 4 script branch

Verification

• focused pytest slices for report spec, report output service, simulation service, alias service, and route coverage
• route coverage for malformed legacy compatibility reads