OptionalcontextOptionalproviderOptionalreasonJustification for a sign-off override. REQUIRED (non-empty) when signOff
overrides a leakage-FLAGGED model — the gate refuses the override without a
reason, then persists a sign-off audit note. Ignored when the model isn't
flagged (sign-off has nothing to override).
The model id + requested transition + sign-off, handed to the gate.