governance: require reviewed-content binding for direct proposal approval #1979

Parent: mctlhq/.github#181
Source: mctlhq/.github#182 decision-assurance audit (G3 / P2).

Problem

The standalone/direct GitOps proposal approval path can call mctl_trigger_approve without expected_content_digest. In that mode the approval operation hashes the current proposal bytes at flip time. This proves only that the proposal does not change after approval; it does not prove that the human reviewed and approved those exact bytes.

This is distinct from the canonical Temporal DevLoop aar_ path, where the reviewed artifact digest is bound before the human decision.

Required invariant

A governed direct approval must bind the exact content reviewed by the human before the decision is recorded:

reviewed_hash=A + approve + current_hash=B (A != B) -> hard fail

No empty/unbound digest mode may silently create an approval binding from bytes first observed at execution time.

Scope

• Determine whether any legitimate caller still requires unbound/empty-digest direct approval.
• Prefer removing the unbound mode. If compatibility requires retaining it temporarily, make it explicitly non-governed and impossible to confuse with a reviewed approval.
• Preserve the existing DevLoop aar_ path and chore(argo): count distinct attachments in the janitor's kept total #681 guarantees.
• Record typed audit evidence for digest mismatch/unbound refusal.

Acceptance criteria

• Direct governed approval requires a caller-supplied digest representing the reviewed proposal content.
• Mutation between review and approval is rejected before state changes.
• Empty/missing digest cannot be interpreted as a governed human approval.
• Happy-path direct approval records the same reviewed digest in approval evidence/status.
• Regression tests fail if execution-time self-binding is restored.

Refs mctlhq/.github#181, mctlhq/.github#182, mctlhq/mctl-agents#681.