Make deploy enforce approval: manual (S-008-1, 3, 5..10, 15, 16) #163

Builds part of spec S-008, docs/specs/008-enforce-manual-approval.md (feature issue #106): the acceptance criteria below. Each needs a test that names its id (test_s008_<k>_..., or a proves: S-008-1 comment line).

This is deploy enforcing approval: manual: the counting rules, the plan's approval object, the MCP tool, the Breaking changelog entry and the docs.

• S-008-1: deploy crm-backend --release R --yes on a project whose application declares approval: manual and whose approvals folder holds no record exits 4 PRECONDITION with context.code: deployment_approval_missing, a message naming the application, crm-backend and R, and context.command equal to cloudfall release approve crm-backend --release R; no ansible-playbook runs and no release receipt is written
• S-008-3: After S-008-2, deploy crm-backend --release R --yes deploys and its result carries approval with that record's path, approver and approvedAt
• S-008-5: cloudfall mcp serve for a project lists no release_approve tool, and its deploy tool called with yes: true for a manual application without a record returns PRECONDITION with deployment_approval_missing
• S-008-6: A record for release R doesn't count when the archive at tmp/artifacts/crm-backend/R.tar.gz and its metadata now give another SHA-256, when the component's declared servers differ from the record's servers, or when expiresAt has passed; deploy --yes refuses with deployment_approval_missing and lists the record with digest_mismatch, servers_changed or expired
• S-008-7: A record naming another release or another component doesn't count for R
• S-008-8: deploy without --yes exits 0, runs no ansible-playbook, and shows approval with policy: manual, status: missing and command before S-008-2, and status: approved with the record's path, approver and expiresAt after it
• S-008-9: For an automatic application, deploy --yes deploys without any record, its plan shows approval: {"policy": "automatic"}, and a file in the approvals folder that isn't valid JSON doesn't stop it
• S-008-10: For a manual application, a file in the approvals folder that isn't valid JSON or doesn't match release-approval.schema.json makes deploy exit RECORD_INVALID naming the file
• S-008-15: A deploy that fails its health gate leaves its approval record unchanged, and a second deploy --yes of the same release before expiresAt uses the same record
• S-008-16: changelog.d/106-enforce-manual-approval.md has a ### Breaking entry naming deploy --yes and migrate --yes on manual applications and both migrations (approve with cloudfall release approve, or switch to approval: automatic), and docs/ci-deploy-guide.md no longer says that no command acts on approval

Depends on #160