feat(architecture): wire approve-architecture consumption (transition to PR 3/6)

[hzcheng]

Summary

Transition PR for the Harness Simplification program (between PR 2/6 and PR 3/6). The decision record (docs/architecture/harness-simplification-decision.md) replaced Architecture Change record machine authorization with owner architecture approval (approve-architecture <full-head-sha>), but the merged gates never consumed it. This wires the consumption path so PR 3/6 (which deletes the record machinery and therefore cannot be authorized by a record) can be evaluated and merged.

Root causes fixed:

• merge-approval gate: evaluated only approve <sha> and base records — a relaxing change that may not add records (ADR: no new records during the window) could never be authorized. The gate now detects the owner's approve-architecture <full-head-sha> comment and threads the verdict into the declaration evaluation.
• quality lane: the architecture change gate demanded approve-architecture <sha> but nothing consumed the comment. The classifier now accepts an architectureApproved verdict; the verify workflow detects the owner comment and exports ARCHITECTURE_APPROVED (PR-lane feedback only — the merge gate re-verifies from the default branch).
• trusted kernel: could not materialize the PR head (the pull_request_target checkout fetches only the base ref, so both git checkout <sha> and git diff base...head failed) and never received the approval flag. The workflow now fetches the PR head first; the kernel looks up the owner's approval comment via the GitHub API (fail-closed).
• architecture-approval job: diffed the base branch against itself (git diff origin/main HEAD where HEAD is the base checkout) and always passed vacuously. It now diffs the base against the fetched PR head SHA.

Skill harvest

Updated .skills/fixing-regressions-with-ci: when a CI check fails, first identify which side of the PR supplies the check's code — pull_request checks run PR-head files, pull_request_target checks (merge-approval gate, trusted kernel) run default-branch files, so a PR-head edit cannot change a default-branch check until it merges. This is the lesson from PR #296's repeated CI failures.

Known red check (bootstrap)

trusted-kernel will fail on this PR: the check runs the default branch's kernel, which cannot yet fetch the PR head (this PR is the fix). After this PR merges, the kernel on main becomes functional and evaluates PR #296 with the approval consumption above.

Change impact declaration

{
  "headSha": "6cc7fca077b4929411d6dbaede79e8e560346ece",
  "capabilities": [
    "MAIN-ARCHITECTURE-HARNESS"
  ],
  "modules": [],
  "invariants": [],
  "policyDelta": "tightening",
  "baselineWaiverDelta": "zero",
  "newFiles": [],
  "behaviors": [
    "ARCH-CHANGE-GATE-001",
    "ARCH-CLOSED-WORLD-001",
    "ARCH-INVARIANT-CATALOG-001",
    "ARCH-MODULE-BOUNDARY-001",
    "ARCH-MODULE-CYCLE-001",
    "ARCH-POLICY-SCHEMA-001",
    "ARCH-PROGRAM-LEDGER-001",
    "ARCH-SINGLE-WRITER-001",
    "ARCH-WEBVIEW-MANIFEST-001"
  ],
  "semanticImpact": {
    "stateAuthority": false,
    "writerSet": false,
    "protocol": false,
    "persistence": false,
    "identity": false,
    "recovery": false
  },
  "coordinators": [],
  "verification": "npm run test-compile; node --test tests/unit/tooling/** tests/unit/architecture/** (565 pass); npm run test:architecture-policy; npm run test:behavior-contracts; npm run lint; node scripts/architecture/checkArchitectureChange.js (classification: tightening)"
}

[hzcheng]

approve 6cc7fca