fix: preserve OpenClaw approval ownership

[peg]

Summary

• stop Rampart bridge from auto-consuming OpenClaw approvals when the native Rampart plugin is installed
• keep deny enforcement automatic while leaving OpenClaw/manual approval records human-owned
• preserve legacy bridge-first auto-allow behavior when the Rampart plugin is not installed
• document the ownership split and add regression coverage for forced/OpenClaw approval modes

Tests

• go test ./internal/bridge ./cmd/rampart/cli ./internal/proxy -count=1
• go test ./... -count=1
• go vet ./...
• go build ./cmd/rampart