Decide an approval raised by a turn

Approves or rejects an action a turn proposed, optionally with edited parameters. The platform executes; the agent never holds the credential (spec §11). Every decision writes an audit row. An EGRESS approval — a parked request to an approval: true host in the version’s network policy — is decided only by an approver the agent version declares (approvals.approvers; empty means any member who can write the session), and its card is editable: false, so editedParams is refused. Authorization: work_session:comment on the session, OR space:contribute on one of its linked spaces; a desk session is writable only by its owner. Any denial is 404.