Promote Onboarded

Promote a training contractor to assignable on Frederick's 2026-09-25 ruling (master-plan unit 2, "A block reaches a contractor"): "Everyone fully onboarded" -- any active contractor who finished onboarding and the ID check. See service. promote_when_onboarded_and_id_verified's own docstring for how this reconciles with certify's 2026-09-19 "non-negotiable" attestation rule. Same contractors:write grant certify needs.

⛔SUPERSEDED IN PART, 2026-09-28 (issue #2335): "a person clicks this, per contractor; nothing calls it on a timer" was true when this route was built and is no longer the ordinary path -- service. try_auto_promote_when_ready now calls this same underlying function automatically, from the onboarding-completion and ID-check-verified events. This route is the manual door: the Contractors-page "Promote" button (apps/web/src/pages/hr/contractors/PeopleTab.tsx) calls it for the case the automatic hook cannot cover -- a contractor who was already training, onboarded and verified before the hook existed.