fix: three things that were known and written nowhere

All three have the same shape — the system learns something and only stderr
hears it — and each was flagged in the handoff as a silent-discard defect.

The gate's install outcome. `container_tool_hooks::install` returned Some or
None and both call sites wrote `let _ =`. A mission whose gate never installed
left a record indistinguishable from one whose gate stood there and matched
nothing. `EnsuredContainer` now carries the outcome to the callers that have a
pool, and they record `gate.installed` (with the settings path) or
`gate.absent` on the mission, so "was this mission gated?" is answerable from
the mission.

The inert marker. `vm_tool_gate` writes an `inert` file when it cannot parse
its input and allows everything, precisely so an inert gate does not look like
a permissive one. The only reader was a unit test. `drain_inert` now reads and
clears it at every tap drain, and a `gate.inert` event with the occurrence count
lands beside the calls that ran unchecked.

The judge's spend. `LlmEvent::Usage` arrived on every judge call and was
matched by `Ok(_) => {}`. Two plan exhaustions (2026-08-29, 2026-09-09) with
no row anywhere saying a judge token had been spent; `usage_events` had no
provider or model column. The loop now accumulates requests and tokens onto the
Verdict — counting a request BEFORE the stream opens, so a 429 the provider
refused still counts, because the retry storm was made of those — and
`record` writes a `kind = 'judge'` row with provider, model, mission and
request count. Migration 0085 adds the columns, all nullable, so the two
existing writers are untouched.

Tests: a scripted-provider verdict records one request and nonzero tokens; a
provider that refuses still records the request and zero tokens.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz

crates/cm-api/tests/phase_conditions.rs

@@ -279,6 +279,7 @@ async fn evaluations_are_unique_per_iteration_and_upsert() {
         error: None,
         checks: Vec::new(),
             independent: false,
+            usage: Default::default(),
     };
     cm_api::evaluator::record(&pool, mission, phase, 0, &first)
         .await
@@ -298,6 +299,7 @@ async fn evaluations_are_unique_per_iteration_and_upsert() {
             evidence: "exit status: 0".into(),
         }],
         independent: false,
+        usage: Default::default(),
     };
     cm_api::evaluator::record(&pool, mission, phase, 0, &second)
         .await
@@ -356,6 +358,7 @@ async fn latest_returns_the_most_recent_iteration() {
                 error: None,
                 checks: Vec::new(),
             independent: false,
+            usage: Default::default(),
             },
         )
         .await