feat: Implement approvals workflow and notifications integration

- Added approvals orchestration with persistence and workflow scaffolding.
- Integrated notifications insights and staged resume hooks.
- Introduced approval coordinator and policy notification bridge with unit tests.
- Added approval decision API with resume requeue and persisted plan snapshots.
- Documented the Excitor consensus API beta and provided JSON sample payload.
- Created analyzers to flag usage of deprecated merge service APIs.
- Implemented logging for artifact uploads and approval decision service.
- Added tests for PackRunApprovalDecisionService and related components.

src/Concelier/__Analyzers/StellaOps.Concelier.Analyzers/AnalyzerReleases.Shipped.md

@@ -0,0 +1,2 @@
+; Shipped analyzer releases
+

src/Concelier/__Analyzers/StellaOps.Concelier.Analyzers/AnalyzerReleases.Unshipped.md

@@ -0,0 +1,9 @@
+## Release History
+
+### Unreleased
+
+#### New Rules
+
+Rule ID | Title | Notes
+--------|-------|------
+CONCELIER0002 | Legacy merge pipeline is disabled | Flags usage of `AddMergeModule` and `AdvisoryMergeService`.

src/Concelier/__Analyzers/StellaOps.Concelier.Analyzers/NoMergeUsageAnalyzer.cs

@@ -0,0 +1,152 @@
+using System;
+using System.Collections.Immutable;
+using Microsoft.CodeAnalysis;
+using Microsoft.CodeAnalysis.Diagnostics;
+using Microsoft.CodeAnalysis.Operations;
+
+namespace StellaOps.Concelier.Analyzers;
+
+/// <summary>
+/// Analyzer that flags usages of the legacy merge service APIs.
+/// </summary>
+[DiagnosticAnalyzer(LanguageNames.CSharp)]
+public sealed class NoMergeUsageAnalyzer : DiagnosticAnalyzer
+{
+    /// <summary>
+    /// Diagnostic identifier for legacy merge usage violations.
+    /// </summary>
+    public const string DiagnosticId = "CONCELIER0002";
+
+    private const string Category = "Usage";
+    private const string MergeExtensionType = "StellaOps.Concelier.Merge.MergeServiceCollectionExtensions";
+    private const string MergeServiceType = "StellaOps.Concelier.Merge.Services.AdvisoryMergeService";
+
+    private static readonly LocalizableString Title = "Legacy merge pipeline is disabled";
+    private static readonly LocalizableString MessageFormat = "Do not reference the legacy Concelier merge pipeline (type '{0}')";
+    private static readonly LocalizableString Description =
+        "The legacy Concelier merge service is deprecated under MERGE-LNM-21-002. "
+        + "Switch to observation/linkset APIs or guard calls behind the concelier:features:noMergeEnabled toggle.";
+
+    private static readonly DiagnosticDescriptor Rule = new(
+        DiagnosticId,
+        Title,
+        MessageFormat,
+        Category,
+        DiagnosticSeverity.Error,
+        isEnabledByDefault: true,
+        description: Description,
+        helpLinkUri: "https://stella-ops.org/docs/migration/no-merge");
+
+    /// <inheritdoc />
+    public override ImmutableArray<DiagnosticDescriptor> SupportedDiagnostics => ImmutableArray.Create(Rule);
+
+    /// <inheritdoc />
+    public override void Initialize(AnalysisContext context)
+    {
+        context.ConfigureGeneratedCodeAnalysis(GeneratedCodeAnalysisFlags.None);
+        context.EnableConcurrentExecution();
+
+        context.RegisterOperationAction(AnalyzeInvocation, OperationKind.Invocation);
+        context.RegisterOperationAction(AnalyzeObjectCreation, OperationKind.ObjectCreation);
+    }
+
+    private static void AnalyzeInvocation(OperationAnalysisContext context)
+    {
+        if (context.Operation is not IInvocationOperation invocation)
+        {
+            return;
+        }
+
+        var targetMethod = invocation.TargetMethod;
+        if (targetMethod is null)
+        {
+            return;
+        }
+
+        if (!SymbolEquals(targetMethod.ContainingType, MergeExtensionType))
+        {
+            return;
+        }
+
+        if (!string.Equals(targetMethod.Name, "AddMergeModule", StringComparison.Ordinal))
+        {
+            return;
+        }
+
+        if (IsAllowedAssembly(context.ContainingSymbol.ContainingAssembly))
+        {
+            return;
+        }
+
+        ReportDiagnostic(context, invocation.Syntax, $"{MergeExtensionType}.{targetMethod.Name}");
+    }
+
+    private static void AnalyzeObjectCreation(OperationAnalysisContext context)
+    {
+        if (context.Operation is not IObjectCreationOperation creation)
+        {
+            return;
+        }
+
+        var createdType = creation.Type;
+        if (createdType is null || !SymbolEquals(createdType, MergeServiceType))
+        {
+            return;
+        }
+
+        if (IsAllowedAssembly(context.ContainingSymbol.ContainingAssembly))
+        {
+            return;
+        }
+
+        ReportDiagnostic(context, creation.Syntax, MergeServiceType);
+    }
+
+    private static bool SymbolEquals(ITypeSymbol? symbol, string fullName)
+    {
+        if (symbol is null)
+        {
+            return false;
+        }
+
+        var display = symbol.ToDisplayString(SymbolDisplayFormat.FullyQualifiedFormat);
+        if (display.StartsWith("global::", StringComparison.Ordinal))
+        {
+            display = display.Substring("global::".Length);
+        }
+
+        return string.Equals(display, fullName, StringComparison.Ordinal);
+    }
+
+    private static bool IsAllowedAssembly(IAssemblySymbol? assemblySymbol)
+    {
+        if (assemblySymbol is null)
+        {
+            return false;
+        }
+
+        var assemblyName = assemblySymbol.Name;
+        if (string.IsNullOrWhiteSpace(assemblyName))
+        {
+            return false;
+        }
+
+        if (assemblyName.StartsWith("StellaOps.Concelier.Merge", StringComparison.Ordinal))
+        {
+            return true;
+        }
+
+        if (assemblyName.EndsWith(".Analyzers", StringComparison.Ordinal))
+        {
+            return true;
+        }
+
+        return false;
+    }
+
+    private static void ReportDiagnostic(OperationAnalysisContext context, SyntaxNode syntax, string targetName)
+    {
+        var diagnostic = Diagnostic.Create(Rule, syntax.GetLocation(), targetName);
+        context.ReportDiagnostic(diagnostic);
+    }
+}

src/Concelier/__Analyzers/StellaOps.Concelier.Analyzers/StellaOps.Concelier.Analyzers.csproj

@@ -0,0 +1,19 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>netstandard2.0</TargetFramework>
+    <AssemblyName>StellaOps.Concelier.Analyzers</AssemblyName>
+    <RootNamespace>StellaOps.Concelier.Analyzers</RootNamespace>
+    <Nullable>enable</Nullable>
+    <LangVersion>latest</LangVersion>
+    <IncludeBuildOutput>false</IncludeBuildOutput>
+    <GenerateDocumentationFile>true</GenerateDocumentationFile>
+    <EnforceExtendedAnalyzerRules>true</EnforceExtendedAnalyzerRules>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Microsoft.CodeAnalysis.CSharp" Version="4.9.2" PrivateAssets="all" />
+    <PackageReference Include="Microsoft.CodeAnalysis.Analyzers" Version="3.11.0" PrivateAssets="all" />
+  </ItemGroup>
+
+</Project>