Implement the engine spine: claim, outbox, machine, API

Contracts first (T02–T04): approval claim schema with issuer, freshness,
and binding digest; local transactional outbox wire; load-bearing cadence
as heartbeat or reconciliation (layer.yaml declared).

Then the object (T06–T08): SQLite closed state machine, CAS supersession,
distinct-approver fail-closed, revocation without holder cooperation,
outbox insert in the same transaction. Tests fail the mutation when
emission fails, and revoke while the drain sink is down.

Introspection GET /v1/approvals/{id}/claim is a PIP fact, not a decision.
No public consume (T05 waits on GH-WP-0002-T06). Canon T-06 coverage for
wrong binding, expiry, revoke, and supersede.

FLEX-WP-0017 T03 is unblocked on this object; T05 remains blocked only on
consumption ordering.

Assistant: grok
Assistant-Session: 01a04ceb-2057-7e20-b0f9-c282964d5dd9

README.md

@@ -20,5 +20,13 @@ Flexibility here would be a defect. Graded, evidence-based progression belongs t
 `maturity-engine`; the two engines are deliberate opposites.
 
 See [INTENT.md](INTENT.md) and [SCOPE.md](SCOPE.md). Declaration: [layer.yaml](layer.yaml).
+Claim: [docs/approval-claim.md](docs/approval-claim.md).
 Origin: `flex-auth` `FLEX-DEC-2026-001`, raised while assenting to the security
 layer model.
+
+```bash
+make test
+python3 -m approval_engine.cli serve --db approvals.sqlite
+```
+
+There is no public `consume`. That waits on `GH-WP-0002-T06`.