kami
5e0c7dfed5
Stage approvals were WS-only (ClientMessage.ApprovalResponse), so a headless run had no way to clear an approval gate — and apps/cli ApproveCommand already POSTs to this path (it 404'd). The route is keyed by session: a session suspends on at most one approval at a time, so ApprovalCoordinator resolves the pending requestId server-side (new pendingRequestFor reverse lookup). Decision maps approve/steer->APPROVE, reject->REJECT; routes through the same ApprovalCoordinator.handleResponse the WS path uses.