research(platform): approvals when using Tirith #359

A policy failure that should pause for a human rather than hard-fail. Today's honest answer is
downgrade-to-warn, because blocking would leave the platform workflow stuck. Two candidate shapes,
both unproven: (1) lean on each CI system's own approval gates (GitHub environments/required
reviewers, GitLab manual jobs) with Tirith exiting the right code and a documented recipe per
platform; (2) sync run status through a GitHub App so an approval on the platform side updates the
PR check. Decide the shape before building; this intersects plan attestation — an approval is only
meaningful if the applied plan is provably the approved one.