feat(apply): make the per-env approval gate hermetic (§3 M3 / Track A M1)

The per-env approval policy was applier-supplied — a hand-crafted request
that omitted `project.environments` was ungated, and flipping a gate to
`confirm = false` in the same request un-gated it. Persist the policy
server-side and enforce against `persisted ∪ declared`.

- Migration 0067: `project_environments (project_id, env_name, confirm)`,
  CASCADE on the project. Written declaratively (delete-then-insert) inside
  `upsert_project_tx`, same tx as the project row + node claim.
- `ProjectRepository::get_environments_by_slug` (read side) +
  `ApplyService::effective_env_policy` union the persisted policy with the
  request's declared one (confirm if EITHER says so — monotonic).
- `env_gate_check` now evaluates the effective policy; the three handlers load
  it before the gate. `plan.approvals_required` is the effective gated set, so
  CI sees a persisted gate even when the manifest omits it.
- The union rule closes both bypasses: an omitted policy still trips a
  persisted gate, and an ungating apply must itself pass the gate (the
  declarative replace then takes effect next time) — TOCTOU-safe.

Pinned by env_approval::{persisted_policy_gates_a_request_that_omits_it,
flipping_a_gate_to_false_in_the_same_request_still_gates} +
projects_repo::get_environments_by_slug_returns_persisted_policy. Schema golden
reblessed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/manager-core/tests/projects_repo.rs

@@ -104,3 +104,47 @@ async fn list_with_owner_and_ancestors_surface_ownership() {
         .expect("get_by_id");
     assert_eq!(by_id.map(|p| p.slug), Some(proj_slug));
 }
+
+#[tokio::test]
+async fn get_environments_by_slug_returns_persisted_policy() {
+    // §3 M3 hermetic gate: the persisted per-env policy round-trips by project
+    // slug. Backs `ApplyService::effective_env_policy` (the `persisted` half).
+    let Some(pool) = pool_or_skip().await else {
+        return;
+    };
+    let projects = PostgresProjectRepository::new(pool.clone());
+
+    let proj_slug = uniq("penv");
+    let (proj_id,): (Uuid,) =
+        sqlx::query_as("INSERT INTO projects (slug, name) VALUES ($1, $1) RETURNING id")
+            .bind(&proj_slug)
+            .fetch_one(&pool)
+            .await
+            .expect("insert project");
+    for (env, confirm) in [("production", true), ("staging", false)] {
+        sqlx::query(
+            "INSERT INTO project_environments (project_id, env_name, confirm) VALUES ($1, $2, $3)",
+        )
+        .bind(proj_id)
+        .bind(env)
+        .bind(confirm)
+        .execute(&pool)
+        .await
+        .expect("insert env policy");
+    }
+
+    let policy = projects
+        .get_environments_by_slug(&proj_slug)
+        .await
+        .expect("get_environments_by_slug");
+    assert_eq!(policy.get("production"), Some(&true));
+    assert_eq!(policy.get("staging"), Some(&false));
+    assert_eq!(policy.len(), 2);
+
+    // An unknown slug yields an empty policy (no gate).
+    let empty = projects
+        .get_environments_by_slug("no-such-project")
+        .await
+        .expect("get_environments_by_slug");
+    assert!(empty.is_empty());
+}