fix(approval): redact reviewer decision text

[XnLemon]

Objective

Close a Phase2 sensitive-output gap by ensuring approval reviewer text is redacted before it reaches logs or user-visible denial results.

Changes

• Sanitized approval reviewer RiskLevel and Reason through the platform redactor before approve logging.
• Reused the sanitized decision text for deny logging and deny PermissionResult reasons.
• Kept approval audit records on stable fixed decision reasons so reviewer text is not written into audit decision fields.
• Added regression coverage for token, api_key, Authorization, and password leakage in approve logs, deny logs, and deny results.

Validation

• go test ./plugin/guardrail/approval ./platform
• go vet ./plugin/guardrail/approval ./platform
• git diff --check
• open-code-review subagent/manual review: 0 High / 0 Medium / 0 Low

Risks / Follow-up

• This increment only sanitizes reviewer-provided approval text at the approval boundary; remaining Phase2 closure items will continue in follow-up fork-only PRs.