Create Operator Eval

Optional client close provenance. close_surface and entry_source are optional; invalid containers or values are ignored, never a reason to reject the close.

Structured operator close-out: what was observed, what was done, how it ended. Stored as one JSONB blob on operator_evaluations.closeout and snapshotted into training_samples.operator_closeout.

TWO INDEPENDENT GATES, and conflating them is the mistake to avoid:

• SHAPE (this model) is validated on EVERY request carrying a closeout, in every deployment, flag or no flag.
• REQUIRED-NESS (which fields a given disposition must fill) lives in EvalService, gated on CLOSEOUT_REQUIRED, because it depends on the disposition AND on deployment state — neither of which belongs in a schema that gets published as openapi.json.

That split is why every field except schema_version is optional HERE. The false-alarm fast path may legitimately post a closeout carrying only an outcome, and a model-level observed: str would 422 it before the matrix got a say. Optional-here, required-there is what lets ONE schema serve both the flag-off rollout window and the flag-on steady state.

observed and outcome_note are CUSTOMER-VISIBLE (brief §5 emails them in site reports): no operator names, no internal jargon. The copy rule is shown inline in the ops-view form; nothing here can enforce it.

UNKNOWN KEYS ARE REJECTED (extra="forbid"), unlike most request models in this repo. This record is versioned and persisted verbatim: with the default extra="ignore" a client typo such as outcome_notes would return 200 and be silently discarded before persistence, which is exactly the data loss a "shape is always validated" contract promises cannot happen. A future shape change bumps schema_version rather than adding keys the old server would have to tolerate. (PR #173 review, P2.)