HV-2: Dossier renderer -- packages/qa/src/dossier.ts + read API

---
feature_id: FEAT-studio-qa
size: M
module: qa
phi_in_scope: true
has_migration: false
write_sets:
  - packages/qa/src/dossier.ts
  - apps/web/src/app/api/studio/[team]/qa/dossier/route.ts
---

## Context

Parent: OPER-196.

Read model that assembles the Feature Dossier from rows that already exist. No new persistence. Given `(featureId, buildSha)` (buildSha optional -- defaults to latest), returns the spec + code claim summary + machine test results + coverage gaps + prior defects + prior HumanVerification responses.

Inputs (all shipped):
- `TestCase` where `featureId = ?` (join key at `qa.prisma:47`)
- `TestRun` latest per case + `TestResult[]` per run
- `AiTriageLog` where `featureId = ?` (prior defect summaries)
- `qa-inbox` trace pointers (Portico POR-778 shipped; ref by traceId in run evidence)
- `HumanVerification[]` for the same featureId across prior buildShas (once HV-1 lands)

## Acceptance Criteria

- `renderDossier({ teamId, featureId, buildSha? }): Promise<Dossier>` in `packages/qa/src/dossier.ts`
- `GET /api/studio/[team]/qa/dossier?featureId=...&buildSha=...` returns the rendered dossier
- Zero new tables; zero new columns
- `Dossier` type is a stable public export from `@operant/qa` (documented in `packages/qa/README.md`)
- Vitest unit tests for empty-history, single-case, multi-case, and no-triage-history cases

---
<!-- planner-rescope: phi_no_reviewer -->
**Planner rescope (phi_no_reviewer):** Task has phiInScope=true but no PHI-eligible reviewer is available. Register a reviewer worker advertising the `phi` capability before admitting PHI work.