security(races): serialize approval transitions with select_for_update + idempotency guard (F-027/028/029)

security(races): serialize approval transitions with select_for_update + idempotency guard (F-027/028/029) #1022