RFC 0029: Attested apps with declared operator debug

[amiller]

Implement Half A only of rfcs/0029-attested-with-declared-debug.md (on main) — the declaration + disclosure. Half B (opening actual debug sessions) is DEFERRED — it rides RFC 0026's debug broker (#58), which is unimplemented, and 0029 revises 0026, so build those two together later. Do NOT build session-opening here.

Simplified design: operator_debug is a single measured boolean (no principals, no scope). A declared door is full trust; anything narrower is a capability, not a debug scope (see the RFC).

Half A tasks (all mirror existing patterns):

1. Add operator_debug: bool to the Project model, next to cap_add/devices (proxy/deploy.py:183).
2. The gate — a two-line mirror of the existing caps gate at proxy/deploy.py:185-186: if operator_debug and mode != "attested": raise ValueError("operator_debug requires mode=attested"). Apply in both deploy paths (deploy.py:185 and :283).
3. Add operator_debug: { enabled, last_session_at } as an RFC 0020 fact in the evidence bundle's app block + the verify/ Facts lib. (last_session_at stays null until Half B; enabled is the live fact now.)
4. Console (RFC 0016): render an 'attested • operator-debug' badge + a lock-down hint on projects where it's true.

Acceptance: deploy an attested project with operator_debug: true → /_api/verification/<name> shows operator_debug.enabled: true; deploying it in dev mode → rejected with the gate error; the console shows the badge. Per the RUBRIC, deploy to webhost-staging and paste /_api/version=.

🤖 Generated with Claude Code

[amiller]

Holding off ready — simplifying the RFC first (binary operator_debug boolean; dropping the over-built principals/scope sub-model). Will re-label ready once the simplified version lands.