feat(ui): emit {renderer,data} tool-result envelope + wire Approval card actions

[rdfitted]

Follow-up from #127 (PR #132) and #123 (PR #131). The tool-render registry renders rich inline widgets, but the backend never emits the result envelope yet — so widgets only render via injected/mocked messages, not real output.

• Emit the { renderer?, data } envelope. Have the orchestrator/adapters (or an Action result wrapper from feat: unified Action contract (define once -> UI/agent/CLI/HTTP) #123) attach the standardized envelope to conversation-message payloads — e.g. renderer: "diff" for git/worktree output, renderer: "table" for structured results — so widgets render end-to-end from real worker/tool output. renderer is a plain string, not a serde-tagged enum (per the epic integration contract).
• Wire the Approval card actions. Approval.svelte's approve/reject events are currently console-logged in ConversationViewer. Wire them to a real injection path / queen endpoint (most naturally an approve action on the feat: unified Action contract (define once -> UI/agent/CLI/HTTP) #123 Action contract) so approval cards can gate destructive worker actions.

Acceptance: a real worker/tool result tagged renderer:"diff" renders the Diff widget inline (not raw text); clicking Approve/Reject on a gated action drives the queen/worker.