feat(comms): route aileron-sh shell approvals through the daemon

[ALRubinger]

Summary

Step 9A of #454. The per-launch approval unix socket (/tmp/ai-{sessionID}.sock) is gone; aileron-sh now POSTs to the daemon's /v1/sessions/{id}/approvals/shell, which long-polls until the user clicks Approve / Deny on the webapp /approvals page.

This is the first half of the comms+approvals daemon-owned work. Step 9B (#454) moves the comms server (read_messages / send / draft / http_request) similarly; that one needs a notification-config migration so it lands as a separate PR.

Surface

New endpoint:

POST /v1/sessions/{session_id}/approvals/shell
Request:  {command, reason?, cwd?}
Response: {decision: allow_once|deny|allow_project|allow_user}

The handler registers a ApprovalKindShell entry on the daemon's existing action-approval queue (the same queue powering /v1/action-approvals for the webapp), blocks on entry.Wait for the action-approval TTL (5 min default), and maps the verdict via the new approval.WireDecision.

Migrations

• aileron-sh switches from unix-socket dial (AILERON_APPROVAL_SOCKET) to HTTP POST (AILERON_APPROVAL_URL + AILERON_SESSION_ID). Same fail-closed semantics on every error path — env unset, daemon unreachable, non-200, garbage body all collapse to deny.
• Launch stops binding /tmp/ai-{sessionID}.sock and stops calling NewApprovalSocketServer; sets AILERON_APPROVAL_URL=daemonURL for child processes.
• Deletes internal/launch/approval.go and approval_test.go (the socket server + RequestApproval client + decision constants).
• New internal/approval/wire_decision.go is the shared home for the four decision-string constants and the (ActionDecision, error) → wire-string mapping. Used by the daemon handler and (in spirit) aileron-sh.

Test plan

• go test ./internal/app/... ./internal/approval/... ./internal/launch/... ./cmd/aileron-sh/... -race is green.
• go vet ./... is clean.
• New tests:
  • handlers_shell_approval_test.go: AllowOnce / AllowProject / Deny / Timeout / 400 missing-command / 400 garbage-body / 503 no-queue.
  • approval/wire_decision_test.go: full mapping table including non-string save_policy, case-sensitive guard, degradation paths.
  • aileron-sh/promptapproval_test.go: env-unset → deny; decision mapping for all four wire strings + unknown; request body shape (command/reason/cwd); unreachable/non-200/garbage all fail closed.
• All existing launch tests still pass — they don't depend on the socket server.

Notes

• Comms server in launch keeps its own per-launch ApprovalQueue for now. Step 9B unifies it with the daemon's queue.
• Settings.AuditLog and aileron.yaml.notifications are still read by launch in the comms path — Step 9B handles the notification-config migration.
• The original conversation's bug (vault re-prompt across CLI + launch) is already fixed by refactor(launch): aileron launch becomes a thin client of the daemon #476; this PR is structural cleanup that makes the architecture honest about where approvals live.

🤖 Generated with Claude Code

[railway-app]

🚅 Deployed to the aileron-pr-479 environment in aileron

1 service not affected by this PR

• docs

[codecov]

Codecov Report

❌ Patch coverage is 92.18750% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 82.35%. Comparing base (a4d87a5) to head (dc7ffc4).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #479      +/-   ##
==========================================
+ Coverage   82.25%   82.35%   +0.09%     
==========================================
  Files         234      235       +1     
  Lines       24153    24112      -41     
==========================================
- Hits        19867    19857      -10     
+ Misses       3143     3117      -26     
+ Partials     1143     1138       -5     

Flag	Coverage Δ
integration	8.43% <0.00%> (+0.02%)	⬆️
unit	79.01% <92.18%> (+0.09%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.