[HIGH-4] Narrative approval has no evidence-citation contract

## Problem

A narrative can reach `Approved` status without any structural link to the evidence that justifies it. There is no enforced contract between an approval state transition and one or more cited evidence records. This breaks source-to-claim traceability — a core requirement for ATO package integrity — and means an AO could sign off on a narrative whose supporting evidence was never formally captured.

## Evidence / Location

- Narrative approval state machine / workflow
- Approval transition logic: no evidence-citation foreign key or validation gate

## Fix

1. Define an `EvidenceCitation` relationship: an approved narrative must reference at least one evidence record (observation, test result, POA\&M item, or control implementation statement).
2. Block the `Approved` state transition if no citations are present; return a structured validation error.
3. Expose citations in the narrative detail view so reviewers can trace approval → evidence.

## Source Reviewers

Vision — HIGH

---
> ⚠️ **Caveat:** All findings are static read-reviews; build/tests were not run. Reproduce before treating fix as confirmed.
> 📋 **Note:** War Machine's ATO/RMF findings are still pending and will be folded in as a second batch.

Locate the narrative approval state machine, approval transition logic, and narrative detail view mentioned in the issue. First trace how approval transitions are validated and how evidence records are represented; then confirm the detail view can expose citations. Done means approved narratives require at least one citation, failures return a structured validation error, and reviewers can follow approval to its evidence.

Written by the indexing model from the issue text.