An approve with no allowance check is not warned about, and the redundancy claim it would make is false for exact-amount approvals

## Reason

Nothing warns on an `approve` that has no upstream `web3/check-allowance`.

A naive version of that warning fires on our own templates. Run over `scripts/seed/workflows/**`, 12 of 43 emit an allowance warning, 11 of them on a plain approve-then-spend, including `aave-v3/mcp-test-supply-weth.json`.

## Plan

Warn on an ungated approve, but treat an upstream approve targeting the same token and spender as satisfying the gate.

Do not claim redundancy. The check reads no on-chain state and no amount. `lib/scan/factory/validate.ts:6-8` blocks MaxUint256, so exact-amount approvals are the normal case and are consumed every run, which makes "this approve changes nothing" false for exactly the shape the platform pushes people toward.

## Scope

Ships and is correct with #2110 and the method-resolution seam absent. The only coupling is that the protocol half reuses `parseProtocolMeta` from that seam, a shared helper rather than a semantic dependency, since `approve` is not in `ALLOWANCE_SPEND_METHODS`.

Found by @cgair while implementing #2110, which is being split into three independently shippable seams.

Start by tracing the allowance-warning scan over scripts/seed/workflows/** and read lib/scan/factory/validate.ts:6-8, including the shared parseProtocolMeta helper from #2110. Done means ungated approve calls are warned about, an upstream approve for the same token and spender satisfies the gate, and no redundancy claim is emitted for exact-amount approvals; compare the seeded workflow warning counts before and after.

Written by the indexing model from the issue text.