Spike: propose-approve-execute round trip for a tool workflow #385

Goal

Prove the loop end to end with pieces we already have: a worker proposes an
ordered set of exact tool calls with _aura_reasoning attached, the whole set
goes out as one multi-item approval webhook with context, and only the approved
version executes. Drift stops the run.

Questions to answer

• Where does the gate move? Today the approval wrapper fires per call inside
  execution; a workflow proposal needs a call site before execution starts.
• What does the proposal look like on the wire - is the existing multi-item
  ApprovalRequest enough, or does it need a workflow envelope (version,
  binding hash)?
• What's the cheapest binding that makes "what was approved is what runs"
  true for a spike?

Timeboxed; findings feed the epic's real tickets.