refactor(infra): move exec approvals into the shared SQLite state DB (#114063)

* refactor(infra): move exec approvals into the shared SQLite state DB

Delete the file-runtime exec-approvals store (exec-approvals.json + .lock
sidecar machinery) on both runtimes and make the reserved
exec_approvals_config singleton row canonical. Doctor owns the one-time
import with claim/verify/receipt discipline; runtime fails closed with a
doctor instruction while un-migrated legacy state exists. The wire CAS
contract, socket semantics, and gateway auth-token derivations are
unchanged. Kills the #113929 lock-contention bug class structurally and
nets around -2.9k lines.

* fix(infra): green CI gates and retire file-era exec approvals tests

Break the migration-type import cycle with a leaf contract, regenerate the
plugin-SDK API and native i18n baselines for the intentional surface change,
drop unused exports, and replace the macOS file-era approvals test suite with
SQLite-backed behavior coverage per the obsolete-internals test policy.

* chore: green max-lines ratchet, native i18n baseline, and unused-export scan

src/cli/program/config-guard.ts

@@ -12,6 +12,7 @@ import {
   resolveStateDir,
 } from "../../config/paths.js";
 import type { ConfigFileSnapshot } from "../../config/types.js";
+import { resolveExecApprovalsPath } from "../../infra/exec-approvals-config.js";
 import { resolveRequiredHomeDir } from "../../infra/home-dir.js";
 import { ExitError, type RuntimeEnv } from "../../runtime.js";
 import { shouldMigrateStateFromPath } from "../argv.js";
@@ -126,10 +127,13 @@ function hasLegacyStateMigrationInputs(): boolean {
     path.join(stateDir, "plugin-state", "state.sqlite"),
     path.join(stateDir, "tasks", "runs.sqlite"),
   ];
+  const legacyExecApprovalsPath = resolveExecApprovalsPath(process.env);
   return (
     [
       path.join(stateDir, "agent"),
       path.join(stateDir, "agents"),
+      legacyExecApprovalsPath,
+      `${legacyExecApprovalsPath}.doctor-importing`,
       path.join(stateDir, "plugins", "installs.json"),
       path.join(stateDir, "restart-sentinel.json"),
       path.join(stateDir, "restart-sentinel.json.doctor-importing"),