feat: Phase 9 gaps closed — ApprovalService.Decide convergence, execlog fold, execworker poller

- ApprovalService (core/app/approval.go) + ApprovalRepo (postgres adapter) with
  full decide transaction: HMAC token verify, approval flip, execution un-gate,
  session-scoped window keys (+session suffix matching GovernanceStore gate),
  nomos session flip, audit+event on failure abort. httpapi DecideApproval now
  a thin presenter delegating to the service. ListPending payload format fixed
  (json.Unmarshal not raw-wrap).
- execlog folded into postgres adapter: internal/execlog deleted, NewExecutionLog
  / ReadExecutionLog live in the db package, callers updated (mcp, httpapi).
- execworker poller over ExecutionService.DispatchQueued: advisory lock leak
  fixed (defer/recover per execution), correlation_id preserved via Finalize
  event emission (ExecRunRepo.Finalize now emits execution.{status} with
  correlation_id from the row).
- Phase 8 session export-rename completed: Store, New, and all 53 methods
  exported; cmd/nomos/ agent.go fixed to use session.PendingContinuation etc.
- Coverage gates: ExecutionService.Submit 93.1%, PolicyService.Decide 100%.
- Plans index updated, VERSION bumped to 0.36.0.

internal/adapters/postgres/governance.go

@@ -234,15 +234,32 @@ func (r *ExecRunRepo) MarkRunning(ctx context.Context, id domain.UUID) error {
 }
 
 // Finalize stamps the terminal status, result payload, duration, and
-// completion time.
+// completion time, and emits an execution.{status} event correlated to the
+// session (the correlation_id is read from the row so every execution path
+// — MCP auto-run, approval, worker — gets a correlated event).
 func (r *ExecRunRepo) Finalize(ctx context.Context, in ports.FinalizeExecutionInput) error {
+	id := mustUUID(in.ExecutionID)
 	_, err := r.pool.Exec(ctx,
 		`UPDATE executions SET status=$2, result=$3::jsonb, duration_ms=$4,
 		        started_at=$5, completed_at=now()
 		 WHERE entity_id=$1`,
-		mustUUID(in.ExecutionID), in.Status, string(in.Result),
+		id, in.Status, string(in.Result),
 		int(time.Since(in.StartedAt).Milliseconds()), in.StartedAt)
-	return err
+	if err != nil {
+		return err
+	}
+	// Emit a correlated execution event for SSE fan-out. The correlation_id
+	// was set on the row at creation time (CreateRun, InsertExecution, etc.)
+	// and is preserved through the lifecycle.
+	var correlationID string
+	_ = r.pool.QueryRow(ctx, `SELECT correlation_id FROM executions WHERE entity_id = $1`, id).Scan(&correlationID)
+	severity := "info"
+	if in.Status == "failed" {
+		severity = "warning"
+	}
+	_ = observability.Event(ctx, sqlcgen.New(r.pool), "execution."+in.Status, &id, severity, "execution", correlationID,
+		map[string]any{"execution_id": in.ExecutionID, "status": in.Status})
+	return nil
 }
 
 // QueueApproval creates the approval row, flips the execution to