List private generation candidates for an owned project

Requires a signed-in JWT user who owns the project; API-key actors are not supported. Lists successful private video takes bound to this project, creator, workspace, and user, excluding takes already assigned in the current shot manifest. Results are candidates only; no automatic attachment or approval occurs. Only safe metadata is returned, with private no-store caching.