Add pending_decisions state-hub query + monthly secrets-elevation review

New context_resolvers/state_hub.py query type: pending_decisions, a thin
GET /decisions/ passthrough (topic_id/workstream_id/workplan_id/decision_type
passed through, status defaults to open). Generic -- not special-cased to
any one decision.

New activity-definitions/monthly-secrets-elevation-review.md: fires 08:00
Berlin on the 1st of each month, sweeps open State Hub decisions under the
infotech/reuse-surface topic, and opens a review task for each. First
target: the temporary autoMode.allow/permissions.allow elevation added to
~/.claude/settings.json on 2026-07-07 (decision 11bf5cbf-458d-4275-a870-
77a82b4058b9, deadline 2026-07-31) for ops-warden/kubectl/OpenBao secret
reads.

Requested by Bernd: no existing scheduling mechanism (session-only cron,
cloud routines with no local access) can durably re-check a local security
posture a month out -- this closes that gap using activity-core's own
durable Temporal-backed trigger instead.

Verified: definition_parser.parse_file + scan_and_parse load it cleanly
alongside the two existing definitions; new resolver tests pass (20/20 in
that file); pending_decisions confirmed against the live local State Hub.
Full suite: 241 passed, 2 pre-existing unrelated failures (confirmed via
git stash -- present before this change too).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/activity_core/context_resolvers/state_hub.py

@@ -9,6 +9,8 @@ Supported queries:
   - next_steps:       GET {STATE_HUB_URL}/state/next_steps
   - workplan_index:   GET {STATE_HUB_URL}/workstreams/workplan-index
   - hub_inbox:        GET {STATE_HUB_URL}/messages/?to_agent=hub&unread_only=true
+  - pending_decisions: GET {STATE_HUB_URL}/decisions/?status=open (topic_id/
+                      workstream_id/decision_type passed through as given)
   - coding_retro:     latest /progress/ item with event_type=coding_retro
   - daily_triage_digest: curated scalar JSON digest for daily WSJF triage
   - recently_on_scope_hourly: POST {STATE_HUB_URL}/recently-on-scope/hourly
@@ -111,6 +113,14 @@ class StateHubContextResolver(ContextResolver):
                 "unread_only": params.get("unread_only", True),
             }
             return _fetch_json("/messages/", query_params)
+        if query == "pending_decisions":
+            query_params = {
+                key: params[key]
+                for key in ("topic_id", "workstream_id", "workplan_id", "decision_type")
+                if key in params
+            }
+            query_params["status"] = params.get("status", "open")
+            return _fetch_json("/decisions/", query_params)
         if query == "coding_retro":
             return _coding_retro(params)
         if query == "daily_triage_digest":