Confirm extraction field values

Confirm that a field should say a given value, signed by the caller, without mutating the machine result. expected_version provides optimistic concurrency; stale writes return 409. Every confirmation and retraction appends an actor- and timestamp-attributed event.

A confirmation whose value matches what extraction produced is a plain sign-off; one that differs also corrects the field. There is no separate approval: who stands behind a value is derived from live confirmations. Retractions are applied first, then confirmations.

A retraction peels the caller's own current tip on that path and restores the value the confirmation replaced. Two retractions of the same path undo two confirmations, in order. A retraction cannot be combined with a confirmation on the same or overlapping path. The tip is not retractable when someone else made it, or when a later overlapping confirmation named a different value. A co-signature of the same value becomes the tip, so only that co-signer can take it back. Completing the review still freezes everything. Provide at least one confirmation or retraction.