scratch matrix approval notifier, add chat-native MCP approval tools

Removes the entire Matrix-based notifier (internal/notifier/) that polled
for pending approvals, sent Matrix alerts, and checked for reaction-based
approve/deny. Approval decisions now work on any chat platform (Hermes
desktop, Telegram, Discord, WhatsApp, CLI) via two new MCP tools:

- list_approvals — query pending/recent approvals by status or entity
- decide_approval — approve/deny via same API endpoint as UI + nomos

Config fields removed: MatrixHomeserver, MatrixUserID, MatrixToken,
MatrixRoomID, ApprovalHMACSecret. Docker notifier: service removed.
Approval HMAC token generation removed (unused by code).

The existing chat-assent path in nomos (cmd/nomos/assent.go) and the
control-room Approve button keep working unchanged — both call the
shared POST /api/v1/approvals/{id}/decision endpoint.

internal/health/health.go

@@ -1,5 +1,5 @@
 // Package health provides a staleness-aware liveness probe for background-
-// loop services (scheduler, notifier) that don't otherwise serve HTTP.
+// loop services (scheduler, execution-worker) that don't otherwise serve HTTP.
 //
 // The owning loop calls Probe.Bump() on each iteration. A /healthz endpoint
 // returns 200 while the last bump is within the staleness window, and 503