phase 3 review: fix broken error classification, stub checks, wasted uuid, token idempotency, dead code

- actuator/ssh.go: custom errorsAs chain broken — all SSH errors classified as SSHErrorOther.
  Replaced with standard errors.As + errors.Is.
- scheduler/scheduler.go: all four check functions were stubs returning healthy.
  Implemented real HTTP GET, TCP dial, unix.Statfs disk, and TLS cert expiry checks.
- learning/learning.go: uuid.NewV7() called unconditionally before ON CONFLICT upsert.
  Now looks up existing pattern first, reuses entity_id.
- notifier/notifier.go: removed dead var_, fixed token regeneration every 15s.
  Now skips if token_hash already set.
- phase3.go: removed dead GetPattern+dummy args call in PatchPattern.
- classify.go: removed unused var_ guard.

internal/notifier/notifier.go

@@ -59,7 +59,11 @@ func processPendingApprovals(ctx context.Context, pool *db.Pool, cfg config.Conf
 			continue
 		}
 
-		// Generate approval token
+		// Generate approval token only if not already generated
+		if a.TokenHash != nil && *a.TokenHash != "" {
+			continue
+		}
+
 		token := generateApprovalToken(a.EntityID, cfg.ApprovalHMACSecret)
 		tokenHash := hashToken(token)
 
@@ -110,7 +114,4 @@ func VerifyApprovalToken(ctx context.Context, pool *db.Pool, approvalID uuid.UUI
 func hashToken(token string) string {
 	h := sha256.Sum256([]byte(token))
 	return hex.EncodeToString(h[:])
-}
-
-// Ensure types are used
-var _ = uuid.UUID{}
+}