Preserve approval of the same commit across publication recovery

[d3cker]

A formal approval submitted after push but before publication recovery was ignored because the dispatcher recorded publishedAt only after updating the PR description. The approved commit was unchanged, yet retrying publication made the review appear too old to authorize merging.

Accept the latest submitted, non-revoked approval for the exact verified PR commit regardless of when description publication completes. Keep timestamp gating for plain merge comments, which do not identify a commit. Preserve allowed-author and repository-permission checks, outstanding change-request handling, GitHub merge-readiness checks, and SHA-pinned merge requests.

Update the configuration/runtime references, architecture, workflow diagram 7 and its explanation, advanced state documentation, and changelog. Clarify that legacy publication timestamps establish a window for merge comments; formal reviews remain bound to the verified commit.

Validation:

• Regression test: approval before delayed publication authorizes the same SHA; a different SHA, revoked review, or old merge comment does not.
• npm run check: lint, typecheck, 214 tests, native TUI rendering, and build.
• All 8 Mermaid diagrams parsed; 91 documentation links checked.

This is a separate PR based on devel after the merge of #20. It does not deploy to the test server.