Post Revision

Append a revision to a verdict. Requires auth + ownership.

Ownership check (R13 B21 fix)

The previous gate was tier != "anon" — any signed-up user could revise ANY verdict, including verdicts owned by other accounts. The outbound webhook then fired with the attacker's revised_to into the operator's calibration trainer. This was a public calibration-poisoning primitive available to a $0 disposable-email signup.

The fix: load the verdict, compare its api_key_hash to the calling key's hash, and 403 on mismatch. Non-existent verdicts return 404 (same as before).