Adopt selected project-validation approval envelope in Core

[rcs2153]

Summary

• add a proof-enforced Core approval envelope for the selected project-validation path
• derive aggregate versus authored approval subject and terminal artifact policy from durable state
• rerun the canonical local check only for grants and cite the exact Core-produced result
• preserve transient aggregate authority, truthful check-free denials, receipt integrity, projection gates, and artifact reconciliation
• add focused tests, an implementation report, and an independent acceptance review

Why

The selected fresh-run and terminal report adapter is already accepted, but CLI adoption must not proceed until approval decisions use the same governed current-fact, evidence, receipt, and artifact boundary. This phase closes that Core gap without changing CLI behavior.

Compatibility and non-goals

This is additive and local. Existing public executor and approval APIs retain default validation behavior. It does not change CLI commands or output, schemas, SDKs, provider or SideEffect execution, automatic approval behavior, hosted behavior, examples, or release posture.

Validation

• cargo fmt --all --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace
• npm run check:docs
• git diff --check
• governed implementation and review phases both completed with proof-enforced approval presentation

Review verdict

The focused maintainer review found no blocker. Combined selected CLI run/approve adoption remains the separately scoped next phase.