feat(ai-env): wire the TypeSafe key and enable Jev shadow gates

AI VM の apply.sh が Secret Manager の selfheal-typesafe-api-key を取得し、
agent コンテナに JEV_KEY_FILE として渡す。ai.env で JEV_MODE=shadow、
JEV_MODEL=jev-1.13.0 を設定し、鍵が未登録でも agent は通常どおり動く
（ゲートは鍵未登録を記録するだけ）。

vm/ai-env/ai.env

@@ -14,3 +14,7 @@ HARNESS_URL=http://10.20.0.11:8080
 MIMIR_URL=http://10.20.0.10:9009/prometheus
 LOKI_URL=http://10.20.0.10:3100
 K8S_API=https://10.10.0.10:6443
+# Jev shadow gates (2026-10-08): off | shadow. shadow records TypeSafe System One answers (triage before the LLM, review after it)
+# next to each diagnosis in ai.jev_shadow and in the harness diagnosis event; it never changes the disposition.
+JEV_MODE=shadow
+JEV_MODEL=jev-1.13.0

vm/ai-env/apply.sh

@@ -20,11 +20,12 @@ SEC=/opt/selfheal/ai/secrets
 mkdir -p "$SEC"; chmod 700 /opt/selfheal/ai "$SEC"
 umask 077
 secret selfheal-openai-api-key    > "$SEC/openai-api-key"
+secret selfheal-typesafe-api-key  > "$SEC/typesafe-api-key"
 secret selfheal-discord-bot-token > "$SEC/discord-bot-token"
 secret selfheal-k8s-ai-token      > "$SEC/k8s-token"
 secret selfheal-k8s-ca-cert       > "$SEC/k8s-ca.crt"
 unset TOKEN
-for f in openai-api-key discord-bot-token; do [ -s "$SEC/$f" ] || echo "note: secret $f is empty (not registered yet); service runs degraded" >&2; done
+for f in openai-api-key discord-bot-token typesafe-api-key; do [ -s "$SEC/$f" ] || echo "note: secret $f is empty (not registered yet); service runs degraded" >&2; done
 for f in k8s-token k8s-ca.crt; do [ -s "$SEC/$f" ] || echo "note: $f is empty (run make token on the operator host)" >&2; done
 chown -R 10002:10002 "$SEC"; chmod 600 "$SEC"/*   # agent/hitl run as uid 10002
 

vm/ai-env/compose.yaml

@@ -10,6 +10,7 @@ services:
       RAG_DSN: "postgres://ai:${RAG_DB_PASSWORD}@rag-db:5432/ai?sslmode=disable"
       HITL_URL: http://hitl:8081
       OPENAI_KEY_FILE: /run/secrets/openai-api-key
+      JEV_KEY_FILE: /run/secrets/typesafe-api-key
       K8S_TOKEN_FILE: /run/secrets/k8s-token
       K8S_CA_FILE: /run/secrets/k8s-ca.crt
       PROMPT_DIR: /etc/ai/prompts