Carry GovernedRunIdentity through ApprovalGatewayPersistenceRequest (fail-closed seams remain in 0.7.1d) #418

Carried forward from the 0.7.1d review (#407) as a tracked gap, deliberately not fixed in 0.7.1e (it is not a query/command-authority concern).

ApprovalGatewayPersistenceRequest does not carry GovernedRunIdentity. Rather than silently dropping attribution, #407 made the affected governed approval creation paths fail closed:

• DefaultApprovalGateway resolves GovernedRunScope.resolve(currentCoroutineContext()) before the first persistence operation and rejects a governed run with GovernedRunContinuityException (before the request factory runs in the Preview path).
• SovereignOpsTransactionalApprovalGateway does the same before calling the mutation store.

Proofs assert 0 approval / 0 suspension / 0 continuation rows and 0 mutation-store calls.

Requested outcome: implement identity carriage through the gateway persistence contract, then relax the fail-closed seams to pass the identity through instead of rejecting. Until that lands, governed runs simply cannot use those creation paths — a hard limitation, not a silent downgrade.

Sequencing: either a small 0.7.1d follow-up slice, or part of 0.7.1g closure after the carriage contract itself is implemented. Must be resolved before 0.7.1 closes.

Evidence: docs/roadmap/0.7.0/TASK-0.7.1d-RUN-ATTRIBUTION.md (non-goals + fail-closed rules), and the 0.7.1e spec's Socratic clause.