Find the run that produced a given external reference URL

Reverse-looks up the agent run that created an EXTERNAL_REFERENCE artifact with the given URL. The URL is matched against the canonical locator stored when the artifact was reported via POST /harness-support/report-artifact with artifact_type EXTERNAL_REFERENCE. Returns 404 when no matching run exists or when the caller lacks access, to avoid leaking run existence.