feat(skillopt): ingest blinded live-pairwise packet → canonical feedback (#77b)

[jerryfane]

What it does

Adds gitmoot skillopt pairwise import <packet-dir>, the consumer side of the #77a seam. It ingests a REVIEWED blinded live-pairwise packet on review close:

• the per-item anonymized A/B options (pairwise-review.json),
• the reviewer's per-item picks (pairwise-picks.json),
• and the SEPARATE secret unblinding map (pairwise-secret-map.json).

For each item it unblinds the anonymous pick (A/B) back to champion vs challenger using the secret_map only, then writes a canonical RankedFeedbackEvent through the EXISTING Mode B recording path (recordSkillOptABPick → ensureSkillOptABRunRows + upsertSkillOptABRankedEvent).

Invariants

• Unblind via secret_map only — resolution comes solely from the secret map and cross-checks mapping against champion_label/challenger_label; an inverted/garbage entry errors instead of silently flipping the preference. Tested for both A→champion and A→challenger orientations (the test FAILS on an inversion), guarding against the Mode B: champion-challenger Thompson-sampling bandit for ask/research agents (pairwise preference → SkillOpt) #473-style label-shuffle inversion.
• Distinct source tag — source=live-pairwise, feedback_source=pairwise_valset, run id prefix skillopt-pairwise: — so validation-set live-pairwise feedback is separable from single-prompt skillopt-ab.
• Idempotent — a STABLE per-item source_url keeps the (run_id,item_id,reviewer,source,source_url) conflict key identical across re-imports, so no double-count (tested: 3× import → 1 row).
• Manual promotion preserved — ingestion writes feedback ONLY; it never promotes or auto-promotes (tested: current version unchanged, no pending version created).
• Fail-safe per item — a missing/garbage secret entry or a missing pick is reported per item without aborting the rest of the import (tested: 1 imported / 2 skipped, exit 1, good row persisted).
• Additive to contract_version=1 — reuses eval_review_options/eval_artifacts/ranked_feedback_events. The Mode B helpers are parameterized by itemID/source/feedback_source; existing skillopt ab + judge callers pass the prior defaults (byte-identical behavior).

Reuse

Consumes the #507 (#77a) packet contract exactly (run_pairwise_eval blinded packet + separate secret_map). Reuses the Mode B path rather than reimplementing recording.

Closes #508