feat: Phase 9 gaps closed — ApprovalService.Decide convergence, execlog fold, execworker poller

- ApprovalService (core/app/approval.go) + ApprovalRepo (postgres adapter) with
  full decide transaction: HMAC token verify, approval flip, execution un-gate,
  session-scoped window keys (+session suffix matching GovernanceStore gate),
  nomos session flip, audit+event on failure abort. httpapi DecideApproval now
  a thin presenter delegating to the service. ListPending payload format fixed
  (json.Unmarshal not raw-wrap).
- execlog folded into postgres adapter: internal/execlog deleted, NewExecutionLog
  / ReadExecutionLog live in the db package, callers updated (mcp, httpapi).
- execworker poller over ExecutionService.DispatchQueued: advisory lock leak
  fixed (defer/recover per execution), correlation_id preserved via Finalize
  event emission (ExecRunRepo.Finalize now emits execution.{status} with
  correlation_id from the row).
- Phase 8 session export-rename completed: Store, New, and all 53 methods
  exported; cmd/nomos/ agent.go fixed to use session.PendingContinuation etc.
- Coverage gates: ExecutionService.Submit 93.1%, PolicyService.Decide 100%.
- Plans index updated, VERSION bumped to 0.36.0.

internal/mcp/discover.go

@@ -6,7 +6,6 @@ import (
 	"strings"
 
 	"github.com/dtoro/oikos/internal/adapters/postgres"
-	"github.com/dtoro/oikos/internal/execlog"
 	"github.com/dtoro/oikos/internal/remote"
 )
 
@@ -34,10 +33,10 @@ func discoverInfraDrift(ctx context.Context, pool *db.Pool) any {
 
 	// 2. DB guests keyed by pve_id.
 	type dbGuest struct {
-		Slug   string `json:"slug"`
-		Type   string `json:"type"`
-		PveID  string `json:"pve_id"`
-		Host   string `json:"host"`
+		Slug  string `json:"slug"`
+		Type  string `json:"type"`
+		PveID string `json:"pve_id"`
+		Host  string `json:"host"`
 	}
 	dbGuests := map[string]dbGuest{}
 	gr, err := pool.Query(ctx,
@@ -65,7 +64,7 @@ func discoverInfraDrift(ctx context.Context, pool *db.Pool) any {
 		}
 		for _, cmd := range []string{"pct list", "qm list"} {
 			out, eerr := sshExecStream(ctx, et.Host, et.User, et.Wrap(cmd),
-				execlog.Sink(func(string, []byte) {}))
+				db.ExecLogSink(func(string, []byte) {}))
 			if eerr != nil {
 				hostErrors[hs+" "+cmd] = eerr.Error()
 				continue
@@ -88,12 +87,12 @@ func discoverInfraDrift(ctx context.Context, pool *db.Pool) any {
 	}
 
 	return map[string]any{
-		"hosts_queried":   len(hosts),
-		"live_guests":     len(live),
-		"db_guests":       len(dbGuests),
+		"hosts_queried":    len(hosts),
+		"live_guests":      len(live),
+		"db_guests":        len(dbGuests),
 		"missing_entities": missing, // in Proxmox, no DB entity
-		"ghost_entities":  ghost,    // in DB, not live in Proxmox
-		"host_errors":     hostErrors,
+		"ghost_entities":   ghost,   // in DB, not live in Proxmox
+		"host_errors":      hostErrors,
 	}
 }
 

internal/mcp/server.go

@@ -20,12 +20,11 @@ import (
 	"time"
 
 	"github.com/dtoro/oikos/internal/actuator"
+	"github.com/dtoro/oikos/internal/adapters/postgres"
+	"github.com/dtoro/oikos/internal/adapters/postgres/sqlcgen"
 	"github.com/dtoro/oikos/internal/core/app"
 	"github.com/dtoro/oikos/internal/core/domain"
 	"github.com/dtoro/oikos/internal/core/ports"
-	"github.com/dtoro/oikos/internal/adapters/postgres"
-	"github.com/dtoro/oikos/internal/adapters/postgres/sqlcgen"
-	"github.com/dtoro/oikos/internal/execlog"
 	"github.com/dtoro/oikos/internal/observability"
 	"github.com/dtoro/oikos/internal/policy"
 	"github.com/dtoro/oikos/internal/remote"
@@ -471,7 +470,7 @@ func sshExec(ctx context.Context, host, user, command string) (string, error) {
 
 // sshExecStream runs a command and reports its combined output, forwarding
 // each chunk to sink as it arrives. A nil sink behaves exactly as before.
-func sshExecStream(ctx context.Context, host, user, command string, sink execlog.Sink) (string, error) {
+func sshExecStream(ctx context.Context, host, user, command string, sink db.ExecLogSink) (string, error) {
 	initSSH()
 	if len(sshKey) == 0 {
 		return "", fmt.Errorf("no SSH key available")
@@ -619,7 +618,7 @@ func classifyAndGate(ctx context.Context, pool *db.Pool, execSvc *app.ExecutionS
 		SessionID:    sessionID,
 		Async:        app.IsLongRunningCommand(command),
 		SinkFactory: func(ctx context.Context, execID domain.UUID, correlationID string) (func(string, []byte), func()) {
-			return execlog.New(ctx, pool, uuid.MustParse(string(execID)), correlationID)
+			return db.NewExecutionLog(ctx, pool, uuid.MustParse(string(execID)), correlationID)
 		},
 	})
 	return renderSubmit(targetSlug, command, res)