fix: bind approvals to the current task

[Lee-take]

Summary

• bind approval controls to the assistant message and exact task permission IDs
• replace repeated per-action clicks with one task-level Confirm and run / Reject decision
• keep historical pending records out of unrelated conversations and preserve manual capability-card decisions
• bump the supported release identity to v1.0.1 and add Lee take attribution
• add v1.0.1 release notes and verified unsigned Windows asset metadata

Validation

• pnpm test:release-local -- --skip-live-deepseek
• 197 source files passed secret scan
• frontend and Node/UI checks passed
• Rust: 852 total, 845 passed, 7 ignored, 0 failed
• isolated Playwright mock verified ordinary Q&A has no historical approval block and one click handles a two-action task
• final installer: 12,716,857 bytes; SHA-256 469C4EFA54F4C94A6E37D28C9C88D331B26E1770C6792DC93D02B451640E2A6F; unsigned

Release boundary

The v1.0.0 tag, Release, notes, and asset remain unchanged. The installer was inspected statically and was not launched or installed.