#111: Preserve append-only decision history

[justsml]

Split from the Wayfinder mega PR #137.

Refs #111

Scope

• Make approval and authorization decision history immutable and expose the custody trail through the project API.

Review notes

This PR is intentionally ticket-scoped. It does not close the referenced issue unless the issue is already complete; CI provides the final integration check.

[justsml]

Council of Dans review: repair/defer. Highest-priority gate: Make terminal decision transitions concurrency-safe with conditional updates/serialization so append-only history cannot lose or overwrite a concurrent decision. Feature flags are not a substitute for authority, evidence-integrity, or durability fixes; use typed modes only where they provide a real rollout boundary.

[justsml]

Council readiness round 2 evidence (head 29f5cc964):

• Branch merged with current main; GitHub reports MERGEABLE and 0 commits behind.
• Fresh CI run 33188257538: Build, Type Check, and Mastra Eval Gates pass.
• Focused public-seam verification at this exact tree: pnpm exec vitest run --config vitest.integration.config.ts tests/integration/decision-history-api.test.ts tests/integration/chain-of-custody.test.ts — 2 files, 6 tests passed, including concurrent terminal-decision winner tests for approvals and authorizations.
• pnpm typecheck passed locally.
• The remaining Biome/Test/Security Audit failures match current-main run 33186404539. The Test failure is the unrelated existing browser-e2e-chat-cancellation.test.ts mock error (page.url is not a function); Security Audit is the existing transitive nanoid advisory; Biome is the existing repository-wide diagnostics set.

The PR-specific TOCTOU and consumed-cancellation blockers are repaired with atomic database predicates. This comment records a baseline exception, not a claim that repository CI is green. Release plan if approved: merge/release this PR alone, then verify decide/revoke/history/custody retrieval and stop on any 5xx or missing history.