Empty build workspaces and opt-in integrity signals

What changed

• New assessments start with every integrity signal off, including keystroke and paste tracking. Recruiters turn on the ones they want for each assessment.
• Open-ended build questions now start with no starter files, only the data files the question needs. Candidates can delete every file, name each new file themselves, and have the AI create the first files from scratch.
• When a question hands out an API key, the candidate's files include an environment file with it, and a key the recruiter replaces shows up when the candidate reloads. Apps in the live preview can now call the major AI provider APIs.