Add cloudfall release approve and its approval record (S-008-2, S-008-4, S-008-11, S-008-12) #160

Builds part of spec S-008, docs/specs/008-enforce-manual-approval.md (feature issue #106): the acceptance criteria below. Each needs a test that names its id (test_s008_<k>_..., or a proves: S-008-2 comment line).

This is the cloudfall release approve command and its ReleaseApproval record.

• S-008-2: release approve crm-backend --release R at a terminal, with R typed back, exits 0 and writes one file under decisions/releases/ that validates against release-approval.schema.json and holds the application, component, release, the artifact metadata's archiveSha256 and gitCommit, the component's servers, the approver, approvedAt, an expiresAt 24 hours later, and via: terminal
• S-008-4: release approve with stdin from a pipe exits 4 PERSON_REQUIRED, a mistyped id exits 4 ATTESTATION_MISMATCH, both with --yes and without, and neither writes a file
• S-008-11: release approve exits PRECONDITION with release_approval_not_required for a component of an automatic application, and with the lifecycle code (lifecycle_artifact_missing, lifecycle_artifact_digest_mismatch) for a missing or tampered artifact, before asking for the release id and without writing a file
• S-008-12: release approve --valid-for 0 and --valid-for 169 are refused as usage errors naming --valid-for; --valid-for 2 writes an expiresAt two hours after approvedAt