feat: Phase 9 gaps closed — ApprovalService.Decide convergence, execlog fold, execworker poller

- ApprovalService (core/app/approval.go) + ApprovalRepo (postgres adapter) with
  full decide transaction: HMAC token verify, approval flip, execution un-gate,
  session-scoped window keys (+session suffix matching GovernanceStore gate),
  nomos session flip, audit+event on failure abort. httpapi DecideApproval now
  a thin presenter delegating to the service. ListPending payload format fixed
  (json.Unmarshal not raw-wrap).
- execlog folded into postgres adapter: internal/execlog deleted, NewExecutionLog
  / ReadExecutionLog live in the db package, callers updated (mcp, httpapi).
- execworker poller over ExecutionService.DispatchQueued: advisory lock leak
  fixed (defer/recover per execution), correlation_id preserved via Finalize
  event emission (ExecRunRepo.Finalize now emits execution.{status} with
  correlation_id from the row).
- Phase 8 session export-rename completed: Store, New, and all 53 methods
  exported; cmd/nomos/ agent.go fixed to use session.PendingContinuation etc.
- Coverage gates: ExecutionService.Submit 93.1%, PolicyService.Decide 100%.
- Plans index updated, VERSION bumped to 0.36.0.

cmd/nomos/tasks.go

@@ -8,6 +8,8 @@ import (
 	"regexp"
 	"strings"
 	"time"
+
+	"github.com/dtoro/oikos/internal/nomos/session"
 )
 
 // Task tools are nomos-LOCAL, not MCP tools. They are session-scoped, and the
@@ -222,7 +224,7 @@ func (a *agent) handleTaskTool(ctx context.Context, sessionID, name string, args
 
 	case "propose_plan":
 		raw, _ := args["steps"].([]any)
-		var steps []PlanStepInput
+		var steps []session.PlanStepInput
 		for _, r := range raw {
 			m, ok := r.(map[string]any)
 			if !ok {
@@ -234,7 +236,7 @@ func (a *agent) handleTaskTool(ctx context.Context, sessionID, name string, args
 			}
 			detail, _ := m["detail"].(string)
 			target, _ := m["target_slug"].(string)
-			steps = append(steps, PlanStepInput{Title: title, Detail: detail, TargetSlug: target})
+			steps = append(steps, session.PlanStepInput{Title: title, Detail: detail, TargetSlug: target})
 		}
 		if len(steps) == 0 {
 			return "error: propose_plan needs at least one step with a title", true
@@ -263,7 +265,7 @@ func (a *agent) handleTaskTool(ctx context.Context, sessionID, name string, args
 		}
 		appendedNote := ""
 		if !hasWritebackStep {
-			steps = append(steps, PlanStepInput{
+			steps = append(steps, session.PlanStepInput{
 				Title:  "Write back: update_entity_attributes + create_relationship + upsert_knowledge",
 				Detail: "Call update_entity_attributes for every entity you ran against (versions, states, counts, timestamps). Call create_relationship for any edge you discovered. Then upsert_knowledge about the affected entities (pass `about` as an array).",
 			})