Opt an environment in/out of frontier-coverage (spec frontier-coverage/v0.1).

Sets kind (drives the expected-dimension prior) and/or frontier_policy (distinctness_theta, require_probe_before_complete, external_integration_required) on the env record — which GET /model/{env}/ coverage|frontier and the at_target gate then read. MERGE semantics at both levels: only fields present in the body are changed, and within frontier_policy only the KEYS SENT are changed (a key set to null is removed, reverting it to its default) — so tweaking one knob can't silently drop another (e.g. a theta tweak must not flip the completeness gate on). Send frontier_policy: null to opt back out wholesale to legacy complete = all at_target. Governed/meta: the loop reads this, never writes it.