Approve and merge (close the loop)

Deferred to the branch-protection phase. For the first release, promotion is just the existing merge (#4929) with no approval step. This issue adds the approval and validation layer on top of the request object (#4861) later.

As a reviewer approving a change (org admin), I want to approve a pending promotion and have it merge into the live workflow, so that the change reaches production through the approval path, the version increments, and the source sandbox is cleaned up automatically.

Part of #4852 (Sandbox DevX epic). Builds on Promote request (#4861).

Outcome

Approving a pending promotion merges the workflow into main, bumps the live version, and archives the sandbox. This closes the round trip.

Acceptance criteria

• Given a pending promotion, when I Approve and confirm, then the workflow merges into main, the version increments (for example v2), and the workflow is live and read-only.
• Given the approval completed, then the source sandbox is archived (read-only, trigger disabled) via the existing scheduled deletion.
• Given the merge, then the version history gains a promotion entry naming the actor and the source sandbox.

Scope

• Approve action (self-serve with a confirmation for MVP), calling Sandboxes.merge(sandbox, parent, %{selected_workflow_ids: [workflow_id]}).
• Set the promotion :merged, record a release on the main workflow, and archive the sandbox via schedule_sandbox_deletion/2.
• Version history shows the promotion entry.

Key surfaces

Lightning.Workflows.Promotions, Sandboxes.merge/4, release recording, and the workflow channel.

Note

A required-reviewer approval policy is a future trajectory. The review object is built so it can be added without rework.

Estimate

5 story points.