Adopt claude-code-action agent-approval-check: enforce human approval on agent PRs via required status check

[gingur]

Operator found https://github.com/anthropics/claude-code-action/blob/main/examples/agent-approval-check.yml — a required status check that fails until N human approvals exist on any PR containing agent-authored commits. Runs from the default branch on pull_request_target + issue_comment, so a PR cannot edit the check to approve itself; agent approvals are excluded from the count.

Why adopt: it converts our trust model ('bot approval never merges — only the Operator's does', hooks#17) from convention into branch-protection enforcement, and it neutralizes any future concern about a bot identity (e.g. the run's GITHUB_TOKEN) satisfying an approval-count rule.

Sketch:

• Thin devkit reusable (or consumer recipe) wrapping anthropics/claude-code-action/agent-approval-check@<pin> with our identities: required_approvals: 1, agent_logins: gingur-bot, agent_emails: <bot-id>+gingur-bot@users.noreply.github.com (post-feat(claude): implement-turn contract updates (base merge, hooks, commit identity) + wake routing fix #90 identity; include noreply@anthropic.com for pre-feat(claude): implement-turn contract updates (base merge, hooks, commit identity) + wake routing fix #90 history).
• Mark agent-approval-check as a required status check + require PRs on protected branches in enrolled repos (operator step; pairs with the hooks#17 merge automation so the automation can't merge early even if buggy).
• PR-triggered → GitHub-hosted by design (no runner input), consistent with routing policy.

Sequencing: alongside/after hooks#15–#17 (PR-lifecycle wiring). Third-party pin note: official anthropics org → version tag per CLAUDE.md pinning policy.