Add banking execution safety workflow

[andrei-hasna]

Summary

• Add a core execution safety workflow for submit, approve, dry-run execute, cancel, retry, reconcile, and returned status states.
• Compose existing idempotency, approvals, immutable audit events, reconciliation hooks, and durable outbox primitives.
• Keep provider side effects disabled: execution queues and marks only provider.dry_run plans with providerSideEffectsEnabled=false and explicit release gates.
• Add workflow regression tests.

Validation

• bun run typecheck
• bun test
• bun run build
• bun run verify:release
• staged/final commit secrets scan: clean

No live money movement performed.

[andrei-hasna]

Post-merge safety review for task 63b649b5:

Validation passed on detached origin/main at merge commit b5f354c: bun run verify:release passed typecheck, 115 tests, build, dist smoke, and pack dry-run.

However, independent adversarial review plus local probes found follow-up blockers in the new execution workflow:

• Rejected approval returns status=approved with reason "Approval is rejected." and no outbox.
• A denied intent can later be approved into dry_run_ready with a pending outbox.
• Cancelling an approved intent does not stop its queued dry-run outbox; execution still returns dry_run_sent.
• executeDryRunOutbox does not verify topic/payload safety fields; a manually enqueued non-dry-run outbox can be marked dry_run_sent.
• Workflow audit events are not chained; verifyAuditLedger failed on workflow-emitted events.

Created follow-up todos task 81c21743: Harden execution workflow safety invariants after PR #1.

Branch note: GitHub origin/main is b5f354c, but the local multi-worktree main lineage has unrelated commits not in origin/main; future validation should use refreshed/detached origin/main until reconciled.

[andrei-hasna]

Worker update for task dd48b5bf:

PR #1 is already merged. Verified current state on 2026-07-06:

• GitHub PR state: MERGED at 2026-07-06T15:18:04Z by andrei-hasna.
• origin/main: b5f354c (Merge pull request Add banking execution safety workflow #1).
• PR head: 8391781.
• PR diff scope: src/core/audit.ts, src/core/execution-workflow.ts, src/core/index.ts, tests/execution-workflow.test.ts.
• GitHub post-merge CI on main: success, run 28802373836, head b5f354c.
• Local validation on detached origin/main b5f354c passed with writable Bun temp/cache: bun run verify:release (115 tests, typecheck, build, dist smoke, pack dry-run), bun run smoke:cli, bun run smoke:mcp.
• Independent adversarial reviewer found no blocker to treating PR Add banking execution safety workflow #1 as merged and CI-validated.

No repo code changes were made by this worker. Since a prior safety-invariant follow-up task (81c21743) was terminal but closed by freshness gate rather than implementation, I created routed follow-up task db791adf for the remaining implementation work, including the reviewer's result-contract gap for executeDryRunOutbox/retryExecutionOutbox.