Release 0.9.0: approve facts whose evidence speaks for itself

[renezander030]

A configured rule can now approve the facts whose evidence speaks for itself, while every inference and every correction still waits for a person.

Added

• workspace.auto_approve (empty by default) lists rules that approve a new fact at filing:
  • {fact_type: source-fact, require: source-link} approves a fact that names its --source and --link.
  • {fact_type: action-record, require: said} approves a fact that carries the reviewer's own words.
  • belief cannot be listed (the configuration is refused), and revise, invalidate and retire always wait, whatever their evidence.
  • A fact filed with --supersedes-rejection always waits for a person.
  • A said rule trusts the caller to pass the reviewer's own words.
  • A rule's approval records decided_by: policy:<type>:<require> and is bound to the content digest like a reviewer's approval.
• kg propose / kg bundle --said "...": the reviewer's own words when the fact is their statement. They are part of the approved digest, pass the secret gate, travel into the episode provenance and name a bundle's source.
• The drain dry run reports decided_by for each planned item: the rule, or reviewer.

Changed

• kg-workspace reject also rejects an approved item, whoever approved it, until a drain claims it. It used to refuse anything but a pending item.
• The drain claims each item under the workspace lock just before its first write, and skips an item rejected or changed since it read the queue. An item with a landed fact can no longer be rejected (retire it instead). A rejection records decided_by: reviewer and drops the approval digest.

Verification

• uv run ruff check .: pass.
• uv run pytest: 215 passed (20 new; the 4 added after review fail on the first push). Two earlier dry-run tests now also expect decided_by: reviewer.
• release_audit.py --allow-remote --identity-base origin/main: pass.
• Container MCP smoke (docker build + scripts/mcp_smoke.py): pass.
• Through the installed CLIs:
  • A sourced source-fact and a --said action-record are approved at filing and labelled in the dry run.
  • A belief with --said stays pending.
  • kg-workspace reject stops an approved item.
  • A configuration listing belief is refused.
  • The 0.8.0 end-to-end run on a real Ladybug file still passes 8/8.
• Help text and MCP tool schemas are unchanged except for --said.

Reviewing

• Base: main at fca90b3. Version 0.9.0 in pyproject.toml, server.json and uv.lock.
• Read config.py (FACT_TYPES, AutoApproveRule.approves) first, then workspace.py (file_facts, _approve, _approving_rule, the reject condition, _claim, _planned), then cli.py and gates.py.
• drain changes only by the claim before each item's first write (_claim). Untouched: ingestion, retirement, the MCP server, retrieval.
• No other PR is open.