feat: Phase 9 gaps closed — ApprovalService.Decide convergence, execlog fold, execworker poller

- ApprovalService (core/app/approval.go) + ApprovalRepo (postgres adapter) with
  full decide transaction: HMAC token verify, approval flip, execution un-gate,
  session-scoped window keys (+session suffix matching GovernanceStore gate),
  nomos session flip, audit+event on failure abort. httpapi DecideApproval now
  a thin presenter delegating to the service. ListPending payload format fixed
  (json.Unmarshal not raw-wrap).
- execlog folded into postgres adapter: internal/execlog deleted, NewExecutionLog
  / ReadExecutionLog live in the db package, callers updated (mcp, httpapi).
- execworker poller over ExecutionService.DispatchQueued: advisory lock leak
  fixed (defer/recover per execution), correlation_id preserved via Finalize
  event emission (ExecRunRepo.Finalize now emits execution.{status} with
  correlation_id from the row).
- Phase 8 session export-rename completed: Store, New, and all 53 methods
  exported; cmd/nomos/ agent.go fixed to use session.PendingContinuation etc.
- Coverage gates: ExecutionService.Submit 93.1%, PolicyService.Decide 100%.
- Plans index updated, VERSION bumped to 0.36.0.

internal/httpapi/actuator.go

@@ -14,7 +14,6 @@ import (
 	"github.com/dtoro/oikos/internal/adapters/postgres"
 	"github.com/dtoro/oikos/internal/adapters/postgres/sqlcgen"
 	"github.com/dtoro/oikos/internal/core/app"
-	"github.com/dtoro/oikos/internal/execlog"
 	"github.com/dtoro/oikos/internal/observability"
 	"github.com/google/uuid"
 )
@@ -80,7 +79,7 @@ const sshExecTimeout = 10 * time.Minute
 
 // sshExecStream runs a command and reports its combined output, forwarding
 // each chunk to sink as it arrives. A nil sink behaves exactly as before.
-func sshExecStream(ctx context.Context, host, user, command string, sink execlog.Sink) (string, error) {
+func sshExecStream(ctx context.Context, host, user, command string, sink db.ExecLogSink) (string, error) {
 	initSSH()
 	if len(_sshKey) == 0 {
 		return "", fmt.Errorf("no SSH key available")
@@ -260,7 +259,7 @@ func (s *Server) executeApprovedAction(ctx context.Context, pool *db.Pool, execI
 		`SELECT correlation_id FROM executions WHERE entity_id = $1`, execID).Scan(&correlationID); qerr != nil {
 		correlationID = ""
 	}
-	sink, flushLogs := execlog.New(ctx, pool, execID, correlationID)
+	sink, flushLogs := db.NewExecutionLog(ctx, pool, execID, correlationID)
 	defer flushLogs()
 
 	var output, cmd string