P2 BLOCKING exit green: approval interception chain end-to-end

- tc-tools: Effect declarations -> §15 GatedCategory mapping, deny-by-default
  external reach, taint invariant property-tested (tainted external effects
  are NEVER auto-allowed)
- tc-safety: pending approvals with exact payload+preview, CAS decide with
  audit + single-use grant in one tx, checkpoint suspend/load, exclusive
  resume claim, expiry sweep, decided-unresumed work queue (migration 0004
  adds the outbox the gated email.send tool writes)
- tc-runtime: resumable LoopState checkpointed to agent_runs; gated tool ->
  approval row -> approval_required/run_suspended events -> suspend; resume
  consumes the grant BEFORE executing (spent grant = no execution), rejection
  feeds a structured refusal in-band; durable resume sweeper; continuous
  journal seq across suspension (tested). ContentPart::Text became a struct
  variant — internally-tagged newtype primitives don't serialize
- tc-api: GET/decide approvals endpoints (409 double-decide, tenant
  isolation), decision triggers in-process resume; full chain proven over
  HTTP incl. gateway resumeFrom continuation
- frontend: approval_required/run_suspended events, suspended reply state,
  inline ApprovalCard (§10: summary, category, exact payload preview,
  approve/reject -> decide + stream re-attach), /approvals queue page, nav
- E2E (14 journeys, workers:1 to serialize the shared backend): gated email
  blocks with disabled composer -> approve -> continuation + ✓ step + reload
  replay; reject -> ✗ step, nothing executed; queue page decides pending

106 Rust + 61 frontend tests + 14 Playwright journeys green.

Co-Authored-By: Claude Fable 5 <[email protected]>

frontend/src/components/safety/ApprovalCard.test.tsx

@@ -0,0 +1,69 @@
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { describe, expect, it, vi } from "vitest";
+
+import { ApprovalCard } from "./ApprovalCard";
+
+const approval = {
+  id: "ap-1",
+  category: "outbound_message",
+  actionType: "email.send",
+  preview: {
+    summary: "Send email to [email protected]",
+    to: "[email protected]",
+    subject: "Q2 numbers",
+    body: "Revenue is up 14%.",
+  },
+};
+
+describe("ApprovalCard", () => {
+  it("shows the summary, category, and the exact payload preview", () => {
+    render(
+      <ApprovalCard approval={approval} agentName="Scout" onDecide={vi.fn()} />,
+    );
+    expect(
+      screen.getByRole("region", { name: "Review and approve" }),
+    ).toBeInTheDocument();
+    // The headline names the action; the preview repeats the exact payload.
+    expect(screen.getByText(/wants to:/)).toHaveTextContent(
+      "Send email to [email protected]",
+    );
+    expect(screen.getByText(/Outbound message/)).toBeInTheDocument();
+    // The preview block carries the exact payload that will execute.
+    expect(screen.getByText(/Revenue is up 14%\./)).toBeInTheDocument();
+  });
+
+  it("approve and reject report the decision and disable the buttons", async () => {
+    const user = userEvent.setup();
+    const onDecide = vi.fn();
+    render(
+      <ApprovalCard approval={approval} agentName="Scout" onDecide={onDecide} />,
+    );
+
+    await user.click(screen.getByRole("button", { name: "Approve" }));
+    expect(onDecide).toHaveBeenCalledWith("ap-1", "approve");
+    expect(screen.getByRole("button", { name: "Approve" })).toBeDisabled();
+    expect(screen.getByRole("button", { name: "Reject" })).toBeDisabled();
+  });
+
+  it("reject reports reject", async () => {
+    const user = userEvent.setup();
+    const onDecide = vi.fn();
+    render(
+      <ApprovalCard approval={approval} agentName="Scout" onDecide={onDecide} />,
+    );
+    await user.click(screen.getByRole("button", { name: "Reject" }));
+    expect(onDecide).toHaveBeenCalledWith("ap-1", "reject");
+  });
+
+  it("falls back to the action type when the preview has no summary", () => {
+    render(
+      <ApprovalCard
+        approval={{ ...approval, preview: { raw: true } }}
+        agentName="Scout"
+        onDecide={vi.fn()}
+      />,
+    );
+    expect(screen.getByText(/wants to:/)).toHaveTextContent("email.send");
+  });
+});