ah-a0y store: MarkQAAnswered's once-only claim is the caller's, not the SQL's Lined Up

Found while refreshing SPEC §15/§7 (ah-e5l).

internal/store/store.go MarkQAAnswered's docstring says it stamps answered_at 'making the answer delivery once-only'. The SQL is an unconditional 'UPDATE yonote_qa SET answered_at = ? WHERE task_id = ?' with no 'AND answered_at IS NULL'. The once-only property actually comes from the CALLER: internal/reconcile/qa.go:385 guards with 'if q == nil || q.AnsweredAt != nil { ... }'. SPEC §6 repeats the same overstatement.

Low severity today — the single reconcile goroutine makes the caller-side guard sufficient — but a second caller (a retry path, a manual re-deliver, the mid-run tools channel) would silently break it and post a duplicate Yonote reply under the bot identity.

Deciding between the two fixes is the actual work, and they are not equivalent.

(a) Make the SQL the enforcement point: add 'AND answered_at IS NULL'. This is stronger — a future second caller cannot break it — but it collides with the method's OTHER documented contract: 'Idempotent: re-marking refreshes the stamp on the same row; a missing row is an error (the caller just read it)'. With the guard added, a re-mark affects 0 rows, which the existing n==0 branch reports as 'no qa row' — wrong, the row exists. So (a) also requires deciding what a re-mark means (a no-op returning nil is the natural once-only semantics) and distinguishing 'already answered' from 'row absent', e.g. with a follow-up existence probe or RETURNING.

(b) Fix the docstring (and SPEC §6) to state the real contract: the stamp is a RECORD, and once-only comes from the caller's read-then-guard.

(a) is the better end state. Do it in a change that also touches reconcile/qa.go, so the caller's guard and the store's guarantee are decided together — this was deliberately not done on 2026-08-05 because internal/reconcile was mid-edit by another agent.

MarkQAAnswered's doc comment, SPEC §6 and the SQL all describe the same contract. If the SQL becomes the enforcement point, a second MarkQAAnswered call on an answered row is a no-op that does not report a missing row, and a genuinely missing row still errors. Covered by a store test.