Any current worker can forge completion of a job assigned to another worker

Reproduction steps:

1. Create a Team with requester, worker W1, and worker W2.
2. Create a pending jobs_out record whose target worker is W1.
3. From W2, create a valid signed and encrypted job_result envelope for the requester's job_id.
4. Deliver it through the normal team_mesh.receive() path.
5. Read the requester's job status.

Expected:
Only the worker targeted by the job offer may resolve that job. A result from another worker must be rejected.

Actual:
W2's envelope passes mesh verification because job_result only requires the worker role. The result handler changes the job to status=done and records W2 as the worker, even though the job was assigned to W1.

Station version (railcall version): station-v0.68
Module slug + version: Not module-specific; Teams offload path

Root cause:
workbench/primitives/team_jobs.py::_handle_incoming_result() matches only job_id. It does not compare env.from_pubkey with the worker recorded in the pending job.

Impact:
The requester can receive a false completion/outcome and false receipt references for an offloaded workflow. No external workflow execution is needed to reproduce the false completion record.

Control:
The mesh role check rejects non-worker senders; the missing validation is the specific worker/job binding.