fix(admission): restrict approval audit sender to the platform tenant

Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

deploy/senders-scope.json

@@ -16,7 +16,7 @@
       "approval-engine"
     ],
     "tenants": [
-      "*"
+      "tenant:platform"
     ],
     "may_write": true,
     "may_read": false,

deploy/senders-scope.yaml

@@ -31,7 +31,7 @@ data:
       {
         "name": "approval-engine",
         "sources": ["approval-engine"],
-        "tenants": ["*"],
+        "tenants": ["tenant:platform"],
         "may_write": true,
         "may_read": false,
         "evidence_kind": "load-bearing"