approval/context Python reference: two fail-open gaps fixed in the Go port need backporting

Two fail-open behaviors in the Python reference were found while reviewing the Go parity ports (#3242, #3261), which fixed them on the Go side. Python should match.

1. Approval coordinator accepts duplicate/negative stage indexes.
`agent-governance-python/agent-mesh/src/agentmesh/governance/approval_protocol/coordinator.py` has no duplicate or negative `stage_index` validation, and `_maybe_resolve` collapses stages via `{s.stage_index for s in chain.stages if s.required}`. A chain misconfigured with duplicate required indexes collapses to fewer distinct approvals than intended. Go now rejects both at `validateConfig` (agent-governance-golang/packages/agentmesh/approval_coordinator.go, PR #3242) and resolves as `invalid_approval_chain` deny.

2. `to_policy_action` allows constrain with an obligation channel and zero obligations.
`agent-governance-python/agent-os/src/agent_os/policies/context_accumulation.py` returns ALLOW for constrain when `has_obligation_channel` is true regardless of empty obligations; that cell is reachable (floor-gated flow action with empty envelope restrictions produces empty obligations), so an unspecified constraint collapses into an unconditional allow. Go now denies constrain with an empty obligation set unconditionally (PR #3261).

Both fixes have table-driven tests on the Go side that can be transcribed. Cross-port parity currently diverges in Python's laxer direction on both points.

Start with agent-governance-python/agent-mesh/src/agentmesh/governance/approval_protocol/coordinator.py and agent-governance-python/agent-os/src/agent_os/policies/context_accumulation.py, then compare the corresponding Go fixes in PRs #3242 and #3261. Transcribe the Go table-driven tests for duplicate or negative stage indexes and empty constrain obligations. Done means the Python behavior and tests match the Go parity cases and deny both fail-open scenarios.

Written by the indexing model from the issue text.