feat: update organism schema and refine assembly versioning

[emilylm]

📌 Summary

This PR tightens the assembly intent lifecycle to make reservations and cancellations explicit and safer under concurrent use.

The intent endpoint now returns a structured JSON envelope including assembly_run_id and manifest_yaml, and cancellation now targets a specific reservation by assembly_run_id instead of cancelling the latest run implicitly. It also consolidates specimen sample selection logic through the optimal-sample helper and keeps intent body optional.

---

🔄 Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 💥 Breaking change (fix or feature that would cause existing functionality to change)
• 🧹 Refactor (code change that neither fixes a bug nor adds a feature)
• 📚 Documentation update
• ⚙️ CI / build / tooling change

---

🧩 Key Changes

• Updated POST /api/v1/assemblies/intent/{tax_id} to return JSON envelope:
  • assembly_run_id, version, status, manifest_yaml
• Made intent body optional while preserving optional tol_id.
• Added strict cancel contract for intents:
  • POST /api/v1/assemblies/intent/{tax_id}/cancel now requires assembly_run_id in request body (optional version guard).
  • Returns 404 when no matching reserved intent exists.
  • Returns unified AppError (409) on version mismatch.
• Refactored specimen selection:
  • _get_manifest_inputs_by_tax_id now delegates to _get_optimal_sample_id_for_tax_id.
  • Reduced duplicated selection logic.
• Updated/added unit tests for:
  • empty-body intent creation
  • invalid data-type error handling
  • intent cancellation success/not-found
  • updated response/request contracts

---

✅ Checklist

• Tests are passing locally / in CI
• New tests have been added for new or changed functionality
• Self-review completed
• Documentation updated (if needed)
• No sensitive data or secrets included

---

🔍 Review Notes

• API contract change to review:
  • POST /assemblies/intent/{tax_id} response is now JSON (not raw YAML body).
  • POST /assemblies/intent/{tax_id}/cancel now requires body payload with assembly_run_id.
• Cancellation behavior is now explicit and run-scoped to reduce accidental cancellation of other reservations.
• Confirm whether downstream clients expect raw YAML from intent endpoint and update consumers if needed.

---

📎 Related Issues / Tickets

• Closes #
• Related to #