(orchestration): Runtime capability elevation via Cedar HITL

## Component

API or orchestration

## Describe the feature

When a headless agent hits a **policy denial** for a resource outside its current scope (file path, egress domain, tool), surface a structured **capability elevation request** to the operator channel; on approval, Cedar issues a narrowed grant and the agent resumes without restarting the task.

## Use case

Static allowlists stall unattended agents on edge cases. Mature deployments separate **enforce** (hard sandbox) from **decide** (dynamic approval for exceptional access). ABCA Cedar HITL covers tool soft-deny but not general **runtime permission expansion**.

## Proposed solution

1. Extend Cedar actions with `capability_elevation_request` payload: `{ resource, action, rationale }`.
2. On soft-deny, transition to `AWAITING_APPROVAL` with elevation-specific event type.
3. Slack/GitHub approve wires to temporary policy overlay (time-boxed, task-scoped).
4. Deny returns agent to alternate path or `NEEDS_HUMAN`.

## Other information

- Complements **rfc-runtime-security-telemetry-layer** and roadmap **Layered credential derivation**.
- Different from **bgagent nudge** (steering content, not permissions).

## Acknowledgements

- [ ] I may be able to implement this feature
- [ ] This might be a breaking change

## Acceptance criteria

- [ ] Elevation request/approve/deny flow documented in `CEDAR_HITL_GATES.md`.
- [ ] Approved elevation expires automatically; audit in `TaskEvents`.
- [ ] Tests with fixture policies for file-read and egress cases.

Start with CEDAR_HITL_GATES.md and trace the TaskEvents integration for the existing soft-deny flow. Then locate the fixture-policy tests for file-read and egress cases. Done means documented request/approve/deny behavior, task-scoped elevations that expire automatically, and audit events for each decision.

Written by the indexing model from the issue text.