test/docs(cli): §3 M3 per-env approval journey; Tier 1 complete

`tests/env_approval.rs`: a `[project.environments]` gating `production` →
`pic apply --env production` refused (names --approve); `--yes` alone does not
bypass; `--approve production` applies; an un-gated `staging` applies freely.
Design doc §3 records M3 shipped and the §6/§3 group-tree Tier 1 (M1 create ·
M2 divergence/reparent · M3 per-env approval) COMPLETE.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/tests/cli.rs

@@ -24,6 +24,7 @@ mod config;
 mod dead_letters;
 mod email_queue;
 mod enabled;
+mod env_approval;
 mod env_overlay;
 mod extension_points;
 mod group_create;
@@ -44,13 +45,13 @@ mod roles;
 mod routes;
 mod scripts;
 mod sealed;
-mod structural_divergence;
 mod secrets;
 mod shared_queues;
 mod shared_topics;
 mod shared_triggers;
 mod staleness;
 mod stateful_templates;
+mod structural_divergence;
 mod suppress;
 mod tree;
 mod triggers;