bug: crystallize() always raises forbidden_self_approval — single-agent sessions cannot be crystallized

[Tet-9]

Description

sessions.crystallize() calls proposals.approve() with
approved_by=approver, where approver is _agent() — the same value
recorded as proposed_by on every proposal filed during the session.

Since approve() now enforces the forbidden_self_approval guard, every
proposal in the session hits the guard and is dumped into failures[].
Single-agent crystallize silently approves nothing and returns an empty
approved list with all proposals in failures.

Steps to Reproduce

1. Start a session as agent alice
2. File one or more proposals within that session
3. Call kb_crystallize(session_id) as the same agent alice
4. Observe: approved is empty, all proposals appear in failures with
   "forbidden_self_approval"

Actual Behavior

All proposals fail silently. No artifacts are written. No error is raised
— the caller just gets an empty approved list.

Expected Behavior

crystallize() is an explicitly trusted operation — the host calls it
knowing the agent is approving its own session. It should either bypass
the self-approval guard or accept a dedicated trusted=True flag.

Environment

• Python 3.11+
• vouch pre-1.0