v0.58.0

Enforced approval policies.

Approval is no longer just opt-in. A policy matches runs by tool, command text, or target inventory, and any matching run is held for approval automatically at submission, so an operator cannot skip the gate. Enforcement lives in the dispatcher, so scheduled and triggered runs are gated the same as hand-launched ones. Admins manage the rules through the /policies endpoints. This is policy-as-code change control neither AWX nor Semaphore offers.