Milestone 4: bind approvals to canonical execution

[anthfuller]

Summary

• bind deterministic synthetic approval to the exact request and action references and digests
• enforce complete scope, policy reference, approving authority, and validity window in OPA and the executor
• reject approval at or after expiration, including zero-length validity windows
• document the implemented approval-binding scope and limitations

Validation

• official OPA 1.20.2 strict validation passed
• 51 tests passed
• prompt, policy, allowlist, settings, contract, and golden-dataset validation passed
• historical whitepaper remains unchanged

Reviewed head: 9f8c963c0c691f4251c949024772839138788aa6

Do not merge until GitHub Actions passes and final independent review approves the unchanged head.