Declare a run's success criteria before its outcome is known

Lets an agent commit, at the start of a run, to the criteria by which that run will be judged when it closes — instead of the run's own success ping grading itself. The declared set is evaluated against the run's ping body when the run closes, using the same evaluator as per-check output assertions; a failed expectation turns that close into a fail with cause assertion.

Immutable: declare-once. A second declaration for the same rid is rejected with 409 and the first set is left unchanged — an agent that could rewrite its criteria mid-run once it can see failure coming would be self-grading again with extra steps.

Every assertion is validated before any write, using the same evaluator this endpoint's response is later judged by (the same validation everywhere): an uncompilable regexp, a matches pattern over 1000 bytes, a missing required field for the given kind, or a json_path containing [, * or $ all fail the request with 400 and nothing is written.

At most 20 assertions are allowed per run, the same cap applied to per-check output assertions.

Unlike per-check assertions, a declared run assertion has no id and no name — nothing about it is ever referenced or edited after this call, and it is not authored by a human choosing an alert label.