feat: Phase 9 gaps closed — ApprovalService.Decide convergence, execlog fold, execworker poller

- ApprovalService (core/app/approval.go) + ApprovalRepo (postgres adapter) with
  full decide transaction: HMAC token verify, approval flip, execution un-gate,
  session-scoped window keys (+session suffix matching GovernanceStore gate),
  nomos session flip, audit+event on failure abort. httpapi DecideApproval now
  a thin presenter delegating to the service. ListPending payload format fixed
  (json.Unmarshal not raw-wrap).
- execlog folded into postgres adapter: internal/execlog deleted, NewExecutionLog
  / ReadExecutionLog live in the db package, callers updated (mcp, httpapi).
- execworker poller over ExecutionService.DispatchQueued: advisory lock leak
  fixed (defer/recover per execution), correlation_id preserved via Finalize
  event emission (ExecRunRepo.Finalize now emits execution.{status} with
  correlation_id from the row).
- Phase 8 session export-rename completed: Store, New, and all 53 methods
  exported; cmd/nomos/ agent.go fixed to use session.PendingContinuation etc.
- Coverage gates: ExecutionService.Submit 93.1%, PolicyService.Decide 100%.
- Plans index updated, VERSION bumped to 0.36.0.

internal/core/app/approval.go

@@ -0,0 +1,65 @@
+package app
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/dtoro/oikos/internal/core/domain"
+	"github.com/dtoro/oikos/internal/core/ports"
+	"github.com/google/uuid"
+)
+
+// ApprovalService is the approval-decision use-case: list pending approvals
+// and decide (approve/deny/revoke), which un-gates the linked execution and
+// persists the audit trail. The driving adapter dispatches the SSH work for
+// approved executions after Decide returns.
+type ApprovalService struct {
+	approvals ports.ApprovalRepository
+}
+
+// NewApprovalService wires the service.
+func NewApprovalService(approvals ports.ApprovalRepository) *ApprovalService {
+	return &ApprovalService{approvals: approvals}
+}
+
+// List returns pending approvals for the given entity.
+func (s *ApprovalService) List(ctx context.Context, entityID domain.UUID, limit int) ([]domain.Approval, error) {
+	return s.approvals.ListPending(ctx, entityID, limit)
+}
+
+// ApprovalDecideCmd is one decide-approval request.
+type ApprovalDecideCmd struct {
+	ApprovalID domain.UUID
+	Token      string
+	Decision   string // "approve" | "deny" | "revoke"
+	Actor      string
+}
+
+// Decide validates the decision, maps to status, and delegates the
+// transactional flip + execution un-gate + audit + event to the repository.
+// Returns the updated approval and, on approve, the execution to resume.
+func (s *ApprovalService) Decide(ctx context.Context, cmd ApprovalDecideCmd) (ports.ApprovalDecideResult, error) {
+	var status string
+	switch cmd.Decision {
+	case "approve":
+		status = "approved"
+	case "deny":
+		status = "denied"
+	case "revoke":
+		status = "revoked"
+	default:
+		return ports.ApprovalDecideResult{}, fmt.Errorf("%w: invalid decision %q", domain.ErrInvalidInput, cmd.Decision)
+	}
+
+	aid, err := uuid.Parse(string(cmd.ApprovalID))
+	if err != nil {
+		return ports.ApprovalDecideResult{}, fmt.Errorf("parse approval id: %w", err)
+	}
+
+	return s.approvals.Decide(ctx, ports.ApprovalDecideInput{
+		ApprovalID: domain.UUID(aid.String()),
+		Token:      cmd.Token,
+		Status:     status,
+		Actor:      cmd.Actor,
+	})
+}