-- Which model independently validates a mission's phase verdicts.
--
-- `CLAWMATES_VALIDATOR_MODEL` is deployment-wide, so proving cross-provider
-- validation meant putting a second provider on the critical path of EVERY phase
-- verdict in the deployment. `cross_provider_judge` deliberately does not fall
-- back to the agent's own provider when the independent judge fails — a verdict
-- silently produced by a same-family model would claim a property it does not
-- have — so a z.ai outage makes phases unmeetable rather than merely unverified.
-- That is the right trade to make per mission, not per deployment.
--
-- NULL  = use the deployment default (`CLAWMATES_VALIDATOR_MODEL`).
-- ''    = explicitly no independent validator; judge with the house model.
-- 'glm:glm-4.7' = this registry spec, subject to the same refusals as the env
--                 default (same-family rejected, unregistered provider rejected).
--
-- No CHECK constraint: which providers a deployment registered is a property of
-- its configuration, not of the schema — the same reason `missions.backend` has
-- none.
ALTER TABLE missions
    ADD COLUMN IF NOT EXISTS validator_model text;