Operator unlock
Mutating actions (catalog import, scaffold, experiment trigger, decision build/apply, artifact import) and the live-log stream require an operator unlock.
RESEARCH_LAB_OPERATOR_TOKEN is not set. In dev the app is open; in production all mutating routes are fail-closed until you set the token.