feat: add agent-native approval plane foundation

[enwaiax]

Summary

Repositions Shuttle around an agent-native approval plane rather than a replayable MCP confirmation token.

• persists human approval requests bound to actor, client, conversation, node, and exact command hash
• adds authenticated Web approval APIs and a Pending Approvals UI
• rejects legacy agent-replayable confirm_token authorization
• isolates automatic SSH sessions by actor/client/conversation/node
• protects HTTP MCP with the service bearer token
• enables strict SSH host-key checking by default
• enriches command audit records with identity and approval provenance
• adds JSON approval listing plus safe-remote-ops and GPU-diagnostics skills
• documents black-box v0.3 baseline findings

Verification

• npm run build
• .venv/bin/ruff check src tests
• .venv/bin/ruff format --check src tests
• .venv/bin/python -m pytest -q
• git diff --check
• local ASGI dogfood: pending queue returned 1 request and Web API transitioned it to approved

Scope / follow-up

This is the focused v0.4 foundation, not a claim of enterprise RBAC or compliance. Follow-up work should add authenticated principal derivation rather than caller-supplied identity, cover file-transfer/node mutations with the same policy/audit pipeline, and run real multi-agent SSH dogfood before a release.