Update Decision Status

Review a decision, and patch the linkage fields on its record.

Body is DecisionStatusUpdate — {status?, superseded_by?, affected_modules?, affected_files?}, mirroring the OSS endpoint. Status and metadata are independent: a request can update either, both, or neither. None preserves a field, [] clears it. superseded_by without status is rejected to mirror the OSS contract. A legacy body of {"new_status": "..."} is also accepted for back-compat with pre-mirror clients (mapped to status).

The two halves are stored differently, and deliberately.

A status change is a review action, so it appends a row to decision_acceptances keyed on (repo_id, decision_id). It used to be written into the artifact, which lives at a head_sha-keyed path — so a confirmation was orphaned by the next push and the decision came back unreviewed. Writing a row also removes a full artifact re-upload and a four-tier cache flush from every confirm; durability and cost are the same change here.

The linkage fields are properties of the record rather than of anyone's judgement, so they still rewrite the artifact. That write remains per-commit and is restored by the next reindex, which is pre-existing behaviour and not what this route is for.

Refusing is a real outcome. The acceptance contract requires a reason, a scope, evidence and an identity, so confirming a decision that names nothing it governs returns 422 listing what is missing rather than recording a confirmation that means nothing.