fix(vault-sync): kb_to_vault skips default post-approve WORKING/DRAFT statuses

[kurosawareiji7007-hub]

kb_to_vault never mirrors the normal post-approve claim/page statuses, so a freshly approved KB looks empty in Obsidian until statuses are hand-edited.

where — src/vouch/vault_sync.py:

def _approved_pages(store):
    for page in store.list_pages():
        if page.status != PageStatus.DRAFT:
            yield page

def _approved_claims(store):
    # Working claims have not been through the review gate; ...
    if claim.status in {
        ClaimStatus.ACTIONABLE,
        ClaimStatus.STABLE,
        ClaimStatus.CONTESTED,
    }:
        yield claim

bug — proposals.approve writes claims/pages with model defaults: ClaimStatus.WORKING and PageStatus.DRAFT. Durable artifacts under claims/ / pages/ have already passed the review gate; WORKING here is not "unreviewed". The vault filters therefore skip the common case. The WORKING comment is incorrect for gate-approved artifacts.

Tests currently paper over this by force-setting ACTIONABLE / ACTIVE in fixtures (tests/test_vault_sync.py), and onboarding force-sets ACTIVE for the starter page.

expected — after propose_* + approve, kb_to_vault / vouch sync should mirror those approved claims and pages. Retracted statuses (ARCHIVED / SUPERSEDED / REDACTED for claims; ARCHIVED for pages) should still stay out of the vault.

suggested fix — include WORKING (and keep excluding retracted) for claims; include DRAFT pages that exist as durable approved artifacts OR promote page status to ACTIVE on approve. Prefer aligning vault filters with "passed the gate and not retracted" rather than requiring a second status promotion step unless that promotion is intentional product behavior (if so, do it in approve() so every surface agrees).