scratch matrix approval notifier, add chat-native MCP approval tools

Removes the entire Matrix-based notifier (internal/notifier/) that polled
for pending approvals, sent Matrix alerts, and checked for reaction-based
approve/deny. Approval decisions now work on any chat platform (Hermes
desktop, Telegram, Discord, WhatsApp, CLI) via two new MCP tools:

- list_approvals — query pending/recent approvals by status or entity
- decide_approval — approve/deny via same API endpoint as UI + nomos

Config fields removed: MatrixHomeserver, MatrixUserID, MatrixToken,
MatrixRoomID, ApprovalHMACSecret. Docker notifier: service removed.
Approval HMAC token generation removed (unused by code).

The existing chat-assent path in nomos (cmd/nomos/assent.go) and the
control-room Approve button keep working unchanged — both call the
shared POST /api/v1/approvals/{id}/decision endpoint.

CONTRIBUTING.md

@@ -74,7 +74,6 @@ internal/           All Go packages
   scheduler/        Observe loop, probes, signals
   actuator/         SSH execution
   learning/         Pattern recognition, anomaly detection
-  notifier/         Matrix notifications, approval tokens
   policy/           Risk classifier
   secrets/          Infisical + SOPS backend
   domain/           Core types: entities, approvals, signals, patterns