main red: scope matrix mocks use the pre-#416 approve signature #439

main at fbe9596 (the #381 merge) fails Unit Tests and Integration Tests:

--- FAIL: TestExecutionEndpoints_ScopeMatrix/plan_parent/all_in_scope/approve
panic: assert: arguments: String(0) failed because object wasn't correct type: mutation reached

Emergent conflict between two PRs that were each green alone. #416 (merged just before #381) changed ApproveAndExecute and RunPlannedPurchaseNow to return (string, error) and started storing approval tokens hashed (config.HashApprovalToken). #381's new internal/api/execution_scope_test.go still:

1. stubs ApproveAndExecute / RunPlannedPurchaseNow with the old single-value Return(err) shape, so the mock panics on args.String(0);
2. stores the raw "email-token" in exec.ApprovalToken in TestRevoke_AuthorizedNonRevocableStatusIs409, so the token cases get 403 "invalid revocation token" instead of the expected 409 (hidden behind the panic until (1) is fixed).

Repro: go test -race -short -run TestExecutionEndpoints_ScopeMatrix ./internal/api/ on origin/main.