Add operating layer backend persistence

[haasonsaas]

Summary

• add operating_layer_evidence persistence table and migration
• include the table in database health validation
• add Helm values/env wiring for production operating-layer evidence capture

Source-of-truth: evalops/maestro-internal#2789

Verification

• node ./scripts/run-vitest.js --run test/db/migration-files.test.ts test/web-health.test.ts test/deploy/helm-maestro.test.ts
• bunx biome check src/db/schema.ts src/db/health.ts test/db/hosted-session-storage.integration.test.ts test/db/migration-files.test.ts test/web-health.test.ts test/deploy/helm-maestro.test.ts deploy/helm/maestro/values.yaml deploy/helm/maestro/templates/deployment.yaml
• bunx tsc -p tsconfig.build.json --noEmit --pretty false

[cursor]

PR Summary

Medium Risk
Adds a required critical-table health check and a new migration that must run before production deploys; enabling the Helm flag assumes Postgres is configured for evidence writes.

Overview
Adds Postgres-backed storage for operating-layer evidence via migration 0009_operating_layer_evidence, a matching Drizzle operatingLayerEvidence model (org/session scoping, capability/kind/subject, JSON evidence, expiry), and indexes for capability/org/session/time queries.

operating_layer_evidence is now a critical table in database health checks (with required column validation), so missing or incomplete schema will mark the service unhealthy.

Helm gains opt-in operatingLayer values (enabled: false by default) that inject MAESTRO_OPERATING_LAYER_ENABLED, evidence store (database), and retention days when turned on. Tests cover the new migration, migration count, default chart render (no env vars), and enabled operating-layer env wiring.

^{Reviewed by Cursor Bugbot for commit e2a97ac. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e2a97ac3b2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Wire the Helm operating-layer flag to runtime capture

When operatingLayer.enabled=true, this chart now advertises production evidence capture by setting MAESTRO_OPERATING_LAYER_ENABLED, but I only found these MAESTRO_OPERATING_LAYER_* names in the Helm template/tests and no runtime code path reads them or writes to operatingLayerEvidence. In that deployment scenario the pod starts with the flag set yet no evidence is captured or retained in Postgres, so operators can enable the chart value and get a false-positive configuration.

Useful? React with 👍 / 👎.