feat: Phase 7 — SeedService, SecretsService, ProvisioningService + ssh Provisioner

Seed ingest/export moves behind ports.SeedRepository (SeedRepo in the
postgres adapter; knowledge ingest absorbed from internal/knowledge,
package deleted). pct_create flow (defaults, template/VMID/gateway
pre-flights, pct create, graph registration) moves from httpapi's
approved-execution path into app.ProvisioningService + the ssh
provisioner adapter; CLI seed/export/secret become adapters over the
services. EntityCreateInput gains EnrolledAt. Plan status corrected:
phases 0-7 shipped, 8 + 9 gates open. VERSION 0.34.1.

internal/httpapi/approvals.go

@@ -179,7 +179,7 @@ func (s *Server) DecideApproval(ctx context.Context, req gen.DecideApprovalReque
 			_ = tx.QueryRow(ctx, "SELECT slug FROM entities WHERE id = $1", targetID).Scan(&targetSlug)
 
 			safego.Go("httpapi:executeApprovedAction", func() {
-				executeApprovedAction(context.Background(), s.pool, execID, targetSlug, actionStr)
+				s.executeApprovedAction(context.Background(), s.pool, execID, targetSlug, actionStr)
 			})
 			// Status only — risk_class was set correctly at request time
 			// (e.g. by policy.ClassifyCommand for `run`); overwriting it to