Record package approval decision refresh

[docushell-dev]

Summary

• Add a guarded package-publication approval decision refresh record.
• Record that candidate activation evidence is present.
• Keep package publication, public installation, source manifest activation, package tags, and public installation wording blocked pending manual exact approval.

Validation

• python3 .github/scripts/test_milestone_e_package_publication_approval_decision_refresh.py
• python3 .github/scripts/test_milestone_e_package_publication_candidate_activation_evidence.py
• python3 .github/scripts/test_public_surface_posture.py
• python3 .github/scripts/claims_gate.py
• python3 .github/scripts/test_milestone_e_validation_source_head_alignment.py
• make milestone-e-prep PYTHON=/private/tmp/ethos-jsonschema-venv-main/bin/python
• python3 .github/scripts/test_ci_workflow.py
• cargo build --locked -p ethos-cli
• make package-publication-dry-run-smoke
• git diff --check

Boundary

Package publication and public installation remain blocked. Manual exact approval is still required before selecting versions, creating package tags, activating source manifests, approving public installation wording, or publishing.