outcome-record: add the broker-required coarse outcome field

[TroyHernandez]

The broker's RECORD_SCHEMA marks operation and outcome REQUIRED; a record
missing either is schema_invalid at write_outcome. The disposable-VM (Part B)
run surfaced a .outcome_record() that omitted outcome -- the hermetic fake
broker validates nothing, so every unit test passed.

• .outcome_record() now derives the coarse outcome from the closed status
  classification: ok for a success status (ok/no_op), error for every
  closed failure or refusal. The detailed per-package result stays in observed;
  the coarse field is never a collapse of it. This mirrors the reference boundary
  (runix-audit-broker tools/rab-exercise.c), which writes the same split.
• .validate_record() gains .PKGOPS_RECORD_REQUIRED (operation, outcome) and
  rejects a record missing either, so a future omission fails hermetically rather
  than only in the VM.
• The R-level refuse path (session_ops.R) already carried outcome (intent +
  status); the native effect-session open_intent gained the field on the runix
  side. This closes the write side of the same finding.

Tests: test_record.R asserts the coarse mapping (success -> ok, every closed
failure -> error) and the required-presence guard; the type-check records now
carry the required pair so the presence guard does not mask the type check.
test_commit.R asserts the written record's outcome on the success, no_op, and
failure paths. 670 tinytest, all pass.

Held as a draft until the fresh-guest Part B run re-proves the fixed native path
against a real broker/polkit.

[TroyHernandez]

Part B authoritative run 4: 68/68 (matrix 23/23) on a real broker/polkit. Per the agreed sequence this coarse-outcome conformance fix merges first; pkgops #9 then rebases onto master to pick it up (bump 0.0.1.9 -> 0.0.1.10). Proven via an integration branch = #9 + this fix cherry-picked (788 tinytest green).