Goals: safely revise a proposed metric before target activation

[tongchen92]

Source and scope

Misrouted NotFair MCP feedback: notfair-mcp#774 (feedback #339).

Current main evidence (commit ab0a2655718c0c116200001a7418e68fe77d352a):

• notfair/src/server/mcp-server/tools.ts exposes propose_goal_metric as intake step 2 and describes a failed verification as retryable.
• notfair/src/server/goals/handlers.ts accepts handleProposeGoalMetric only while goal.status === "intake"; its successful write moves the goal to proposed and records a baseline snapshot.
• handleProposeTarget is the later transition from proposed to active. amend_goal is intentionally limited to active/paused goals.

A user can discover a corrected metric definition after the initial server-side verification but before proposing a target. The current lifecycle rejects the correction because the goal is already proposed, leaving no safe pre-activation revision path.

Requested bounded behavior

Add a dedicated pre-activation metric revision path, or safely extend the intake metric operation, for an owned proposed goal whose target_value is null. It must re-run the new definition server-side before replacement and preserve the no-live-loop state.

Acceptance checks

1. An owned proposed goal with no target accepts a corrected, server-verifiable primary metric definition and updates baseline/source/direction atomically.
2. A failed verification, missing source connection, invalid query, non-owner request, intake/active/paused/terminal status, or any goal with a target leaves the existing metric and baseline unchanged.
3. The revision does not set target/cadence/deadline/spend or start a goal tick; target confirmation remains the only transition to active.
4. tools/list exposes the intended revision contract clearly enough that an agent does not attempt unsafe active-goal changes through it.
5. Focused handler and MCP tool/schema/registration regressions pass without real credentials, plus package typecheck.

Non-goals

• No OAuth, credential, account-selection, billing, live provider mutation, or customer-data change.
• No active/paused primary-metric amendment; that distinct lifecycle need is tracked in Goals: safely amend an active primary metric after explicit user confirmation #101.
• No automatic/silent metric replacement or history backfill.