Request ZK proof

Request a zero-knowledge proof for a checkpoint's verdict derivation. The prover input is built from the stored checkpoint (verdict, concerns, reasoning summary, thinking-block hash, model, card hash and values hash), the same input the sampled and deferred proof paths send. The caller must be a member of the org that governs the checkpoint's agent. Any other caller gets the same 404 as a missing checkpoint. If a proof already exists, returns 200 with its current status and nothing is charged. Failed, dead-lettered and skipped proofs are never re-queued. If the existing proof was deferred, it is resolved and dispatched to the prover and returns 202 with the existing proof_id. Otherwise a pending proof is created and dispatched to the SP1 prover service (202). Each newly queued or deferred-resolved proof is charged in μ (class analyze.zk-proof, one unit, deduplicated per checkpoint) to the billing account of the org that governs the agent. If that billing account cannot be resolved, no proof is queued (503, or 409 when the org has no billing account). A synthetic checkpoint, or one whose stored verdict or concerns the prover cannot read, is refused with 409 and error code proof_inputs_unavailable. A checkpoint that predates the stored card and values hashes is refused with 409 and error code proof_inputs_partial. When no prover is bound on the deployment the request is refused with 503 and error code prover_unavailable. For every refusal no proof is queued and nothing is charged.