feat: Implement approvals workflow and notifications integration

- Added approvals orchestration with persistence and workflow scaffolding.
- Integrated notifications insights and staged resume hooks.
- Introduced approval coordinator and policy notification bridge with unit tests.
- Added approval decision API with resume requeue and persisted plan snapshots.
- Documented the Excitor consensus API beta and provided JSON sample payload.
- Created analyzers to flag usage of deprecated merge service APIs.
- Implemented logging for artifact uploads and approval decision service.
- Added tests for PackRunApprovalDecisionService and related components.

docs/modules/orchestrator/README.md

@@ -1,12 +1,15 @@
 # StellaOps Source & Job Orchestrator
 
-The Orchestrator schedules, observes, and recovers ingestion and analysis jobs across the StellaOps platform.
-
-## Responsibilities
-- Track job state, throughput, and errors for Concelier, Excititor, Scheduler, and export pipelines.
-- Expose dashboards and APIs for throttling, replays, and failover.
-- Enforce rate-limits, concurrency and dependency chains across queues.
-- Stream structured events and audit logs for incident response.
+The Orchestrator schedules, observes, and recovers ingestion and analysis jobs across the StellaOps platform.
+
+## Latest updates (2025-11-01)
+- Authority added `orch:quota` and `orch:backfill` scopes for quota/backfill operations, plus token reason/ticket auditing (`docs/updates/2025-11-01-orch-admin-scope.md`). Operators must supply `quota_reason` / `quota_ticket` (or `backfill_reason` / `backfill_ticket`) when requesting elevated tokens and surface those claims in change reviews.
+
+## Responsibilities
+- Track job state, throughput, and errors for Concelier, Excititor, Scheduler, and export pipelines.
+- Expose dashboards and APIs for throttling, replays, and failover.
+- Enforce rate-limits, concurrency and dependency chains across queues.
+- Stream structured events and audit logs for incident response.
 
 ## Key components
 - Orchestrator WebService (control plane).
@@ -19,10 +22,11 @@ The Orchestrator schedules, observes, and recovers ingestion and analysis jobs a
 - Scheduler/Concelier/Excititor workers for job lifecycle.
 - Offline Kit for state export/import during air-gap refreshes.
 
-## Operational notes
-- Job recovery runbooks and dashboard JSON as described in Epic 9.
-- Audit retention policies for job history.
-- Rate-limit reconfiguration guidelines.
+## Operational notes
+- Job recovery runbooks and dashboard JSON as described in Epic 9.
+- Audit retention policies for job history.
+- Rate-limit reconfiguration guidelines.
+- When using the new `orch:quota` / `orch:backfill` scopes, ensure reason/ticket fields are captured in runbooks and audit checklists per the 2025-11-01 Authority update.
 
 ## Epic alignment
 - Epic 9: Source & Job Orchestrator Dashboard.