fix(compliance): revoke badges on monitoring opt-out

[bokelley]

Closes #6386.

Policy

• Registry visibility controls discovery only. A known agent URL can still be checked for an earned badge.
• Compliance opt-out immediately revokes and suppresses all badge roles and versions, with no grace period.
• Re-enabling monitoring does not restore prior trust state; a fresh passing full-suite run must requalify the agent.
• Unknown, opted-out, and otherwise ineligible agents return the same public unverified shape.

Implementation

• Makes opt-out and badge revocation one serialized database transaction.
• Adds a monotonic requalification generation and per-attempt CAS token so stale or concurrent runs cannot restore badges.
• Applies the opt-out/requalification gate to every public badge read and badge-bearing response, with no-store JSON and revalidated SVG caching.
• Keeps shared Slack and feed events public-only while preserving owner notifications.
• Backfills existing opted-out agents and updates operator status, OpenAPI, and policy documentation.

Validation

• Product, code, and security expert reviews: approved with no blockers.
• Focused badge/route/database tests: 63 passed.
• Full server unit suite: 426 files, 5,958 passed, 30 skipped.
• Typecheck, OpenAPI generation, migration validation, docs navigation, docs drift, changeset scope, and diff checks passed.
• Database-backed race test runs when DATABASE_URL is available in CI; it is skipped locally without a test database.

No changeset: this changes the website compliance service and its OpenAPI surface, not a protocol package release surface.

[aao-secretariat]

Ladon verdict: Approve

Approve — badge revocation on compliance opt-out plus a monotonic requalification gate.

Platform-only change (server/, registry OpenAPI, docs/building). No protocol schema surface (static/schemas/source/) touched; registry.yaml is explicitly excluded from protocol changeset scope (check-changeset-protocol-scope.cjs:92), so no changeset required. No spec drift, no oneOf regression, no released-artifact mutation.

Concurrency design verified sound: opt-out and revocation run as one serialized transaction under pg_advisory_xact_lock; the guarded upsertBadge SELECT...WHERE NOT EXISTS(compliance_opt_out=TRUE) fails closed under the shared lock; active-badge reads filter on COALESCE(compliance_opt_out,FALSE)=FALSE AND COALESCE(badge_requalification_required,FALSE)=FALSE. Migration 543 judged as production-facing (runs on startup) and is additive.

Well-covered by race, unit, and route tests. No blocking or medium findings.

Decision-table walk: no critical/high findings (row 1 n/a); gated_paths false (row 2 n/a); high_risk true but reasons are (modified)/(added) only — no deletions (row 3 n/a); no medium findings at all (rows 4/5/8 n/a); no prior escalation (row 6 n/a); no no-auto-approve team match (row 7 n/a). Falls through to row 9 — approve. high_risk is a look-closer heuristic; the (modified) files carry no medium-or-higher concern, so they are presumed safe.