refactor(artifacts): extract shard-finder out of transcripts router

Move `_find_shard_with_sid`, `_resolve_shard`, `_validate_names`,
`_get_index`, and the index cache from
`decnet/web/router/transcripts/api_get_transcript.py` into
`decnet/artifacts/shards.py`. The shared module speaks
`ValueError`; the router keeps thin wrappers that translate to
`HTTPException(400)` so the route's error UX is unchanged.

This unblocks the BEHAVE-INTEGRATION Phase 4 worker wiring — the
profiler worker (and the collector's session aggregator) need to
disk-reach asciinema shards but must not import from a FastAPI
router.

11 new unit tests for the shared helper. Existing transcript router
tests pass (the shard fixture's monkeypatch points at the shared
module's ARTIFACTS_ROOT now).

tests/api/transcripts/test_get_transcript.py

@@ -66,9 +66,11 @@ def shard(tmp_path, monkeypatch):
     shard_path = _write_shard(root, _DECKY, "ssh", _SHARD_NAME,
                               [lines_a[0], lines_b[0], lines_a[1], lines_b[1], lines_b[2], lines_a[2]])
 
+    from decnet.artifacts import shards as _shards
     from decnet.web.router.transcripts import api_get_transcript
+    monkeypatch.setattr(_shards, "ARTIFACTS_ROOT", root)
     monkeypatch.setattr(api_get_transcript, "ARTIFACTS_ROOT", root)
-    api_get_transcript._INDEX_CACHE.clear()
+    _shards._INDEX_CACHE.clear()
     return shard_path