APPROVAL-WP-0007: record the verified revoker and park the inactive plans

Schema v9 stores who revoked an approval and an optional bounded reason.
The bounded-execution carrier example is proven in process. APPROVAL-WP-0005,
0006, and 0007 are blocked because they are not current work. Task statuses
stay as they were, apart from T03 and T04, which are done in source.

Assistant: grok
Assistant-Session: 01a1b5fd-0c33-7ba1-b383-53937d525595

examples/bounded-execution-approval-request.json

@@ -0,0 +1,21 @@
+{
+  "binding": {
+    "action": "bounded-execution",
+    "actor": "service:nk-bind-executor",
+    "principal": "admin",
+    "purpose": "synthetic bounded-execution carrier",
+    "target": {
+      "admission_id": "BEA-SYNTH-0001",
+      "admission_digest": "sha256:7b91434ed31962216e60117b989335bd55b0a679d2dfc1609cd4013dee45a947"
+    }
+  },
+  "validity": {
+    "not_before": "2026-08-29T11:00:00+00:00",
+    "expires_at": "2026-08-29T15:00:00+00:00"
+  },
+  "required_count": 1,
+  "human_control": true,
+  "pdp_path": false,
+  "required_assurance": {"level": "aal2"},
+  "actor_consumes": true
+}