Record what an operator repaired, and let debt count incidents

Slice B, second half. OperatorInterventionRecorded is the one command for
saying "I fixed this by hand": a manual repair happens outside Orchestra by
definition, so the only honest way to have the evidence is for the person
who made it to state it. Inferring "an operator probably intervened" from a
gap would put guesses into the record the ledger is built from.

The debt projection now consumes both new kinds. A closed incident is one
observation carrying its repeat count as intensity, so recurrence stays a
count of independent incidents: 301 repeats on one lease and 2 on another
is a recurrence of two with an intensity of 303, not a recurrence of 303.

Both kinds were previously reported as holes in the system. They are
ordinary evidence now, so their absence from a history is a fact about that
history, and the gap list says so.

The worker also stamps a per-process incarnation on registration and every
heartbeat. Nothing else on the wire distinguishes a restarted worker from a
running one, and an incident cannot outlive the process that reported it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CVbaKucEYBjMqVeUgJUsc1

internal/operations/observations.go

@@ -199,3 +199,42 @@ func firstOr(t, fallback time.Time) time.Time {
 	}
 	return t
 }
+
+// RecordIntervention writes down a repair the operator made by hand. It is
+// deliberately an explicit act: Orchestra cannot see a worker someone
+// restarted or a transaction someone deleted, and inferring "an operator
+// probably intervened" from a gap in the log would put guesses into the
+// evidence the ledger is built from.
+func RecordIntervention(s *store.Store, surface authz.Surface, in domain.OperatorIntervention) (domain.Event, error) {
+	if err := in.Validate(); err != nil {
+		return domain.Event{}, err
+	}
+	if in.At.IsZero() {
+		in.At = time.Now().UTC()
+	}
+	taskID := in.TaskID
+	version := 0
+	if taskID != "" {
+		t, ok := s.Task(taskID)
+		if !ok {
+			return domain.Event{}, domain.ErrNotFound
+		}
+		version = t.Version + 1
+	} else {
+		// A repair with no task is still about this deployment, so it lands on
+		// the same aggregate the other worker-scoped facts use.
+		taskID = "system"
+	}
+	b, err := json.Marshal(in)
+	if err != nil {
+		return domain.Event{}, err
+	}
+	e := domain.Event{
+		ID: domain.NewID(), Type: domain.EventOperatorInterventionRecorded,
+		TaskID: taskID, Version: version, At: in.At, Payload: b, Surface: string(surface),
+	}
+	if err := s.Append(e); err != nil {
+		return domain.Event{}, err
+	}
+	return e, nil
+}