Record Finding Event Endpoint

Record one fixer-lifecycle audit action against a platform finding.

The workflow calls this exactly once per PR it opens, with action: "pr_opened" and evidence citing the finding's signature, occurrence count, agent count, and Commons ref (the same numbers the PR body itself must cite, per the fixer's guard rule 5) plus the PR number and URL. A caller may also record pr_merged, deployed, verified, or did_not_hold through the same path, though in practice only the fixer workflow ever calls this endpoint - the other four actions are written in-process by the platform-fix-verify scheduler job. fix_failed (TOS-6462) is the release path: the claimed run failed before opening a PR, the finding STAYS 'shipped' (the state the hourly claim query selects - review round 14, P1-2), and the workflow PATCHes the Commons item back to 'backlog' in the same failure step so the next hourly run can re-claim. no_longer_reproduces (TOS-7267) is the no-op path: the fixer's first step found the claimed finding no longer occurs, so it moves 'shipped' to 'quiet' and no PR opens. Only these seven fixer-lifecycle actions are accepted (:data:FIXER_LIFECYCLE_ACTIONS) - the original approve/decline/ship actions go through their own dedicated endpoints, not this one.