Unconfirm Page Verification

Withdraw a page's confirmation, restoring its pre-confirm derived status.

The inverse half of confirm, added so Ctrl+Z can reverse a confirmation (RUD-282 Wave A). No migration: all four columns confirm writes are already nullable and status derives purely from them.

Deliberate consequence, carried from the design's §8 verbatim: "undo there can unlock a page another user verified. In scope, but it makes undo the one mutation path that toggles the gate other mutations respect — called out deliberately rather than discovered later." This route enforces project-write, not confirmation ownership, so a second reviewer's confirmation is reversible. Rationale and the alternatives rejected: ADR-0170.

Idempotent on a never-confirmed page: it returns the current derived status rather than 409, so replaying an undo against a page someone else already unconfirmed succeeds instead of dropping the history entry.