fix(approvals): preserve first concurrent resolution

[rissrice2105-agent]

Summary

• make the approval transition out of pending conditional in the update itself
• preserve the first submit/kill decision when concurrent requests read the same pending row
• add a deterministic integration regression that reproduces the interleaving

Validation

• focused approval-resolution regression: 1/1 passed
• complete PWA suite: 115/115 passed
• full repository suite: 365 passed, 5 skipped; the remaining 7 failures are pre-existing POSIX shell/signal assertions on Windows
• syntax checks and git diff --check passed

Closes #100