feat: language parity for require_approval approval chains (TypeScript, .NET, Rust, Go)

## Summary

#2478 adds a `require_approval` verdict plus the approval-chain execution layer (human, LLM judge, and webhook approvers, action binding per ADR-0030, configurable timeouts, and audit linkage) to the **Python** PolicyEvaluator and `govern()`. This issue tracks bringing the same approval-chain execution to the other AGT language SDKs, so governance behavior stays consistent across the ecosystem.

The Python wiring is landing under #3067 (PolicyEvaluator / `govern` integration after ADR-0030). This tracker is the single place to follow the non-Python work.

## What Python adds (#2478, #3067)

- A `require_approval` verdict that pauses execution and routes the decision to an approval chain.
- Approval chains: an ordered list of approvers that short-circuits on the first deny.
- Approver types: human (notification plus vote with a timeout), LLM judge (a model votes allow or deny with a reason, with verdict caching), and webhook (POST the context, expect a JSON verdict).
- Action-bound, fail-closed coordination per ADR-0030 (action binding plus digest, with a configurable timeout that defaults to deny).
- Audit records for the approval request, each vote, and the final verdict.

## Gap in other SDKs

All four SDKs already recognize the `require_approval` verdict and carry an approver count, but none implement the approval-chain execution layer (no coordinator, no approver types, no timeout or audit linkage):

| SDK | Path | Current state |
|-----|------|---------------|
| TypeScript | `agent-governance-typescript/` | `require_approval` is a valid policy action in `src/policy.ts`, no chain execution |
| .NET | `agent-governance-dotnet/` | `PolicyAction.RequireApproval` plus an `Approvers` list in `Policy/PolicyDecision.cs`, no chain execution |
| Rust | `agent-governance-rust/` | a "requires-approval" decision plus `min_approvals` in `agentmesh/src/policy.rs`, no chain execution |
| Go | `agent-governance-golang/` | `RequiresApproval` plus `MinApprovals` in `packages/agentmesh/policy.go`, no chain execution |

## Proposed work

For each SDK, port the approval-chain execution layer on top of the verdict support that already exists:

- route a `require_approval` verdict to an ordered approval chain that short-circuits on the first deny
- implement at least the webhook approver as the MVP, then human and LLM judge approvers where the SDK has the surface for them
- honor the action-bound, fail-closed semantics from ADR-0030 (action binding plus digest, timeout defaults to deny)
- record the approval request, votes, and final verdict on the audit trail
- add tests covering the allow, deny, and timeout paths

One PR per language keeps each change reviewable. Where an approver type does not map cleanly onto a given SDK runtime, note it as not applicable rather than forcing it.

## References

- Source feature: #2478 (Python design and implementation)
- Python wiring: #3067 (PolicyEvaluator / `govern` after ADR-0030)
- Design anchor: ADR-0030 (action-bound, fail-closed approval protocol)
- Parity precedent: #2986, #2537

Start with ADR-0030 and the Python references #2478 and #3067, then inspect the existing verdict support in src/policy.ts, Policy/PolicyDecision.cs, agentmesh/src/policy.rs, and packages/agentmesh/policy.go. Implement the approval-chain execution separately for each SDK, beginning with webhook approval where applicable. Done means allow, deny, and timeout tests cover fail-closed action binding, audit records, and ordered-chain behavior.

Written by the indexing model from the issue text.