Add trusted exact-deletion gate approvals

[Pigbibi]

Summary

• allow the deterministic gate to accept only exact deletion paths pre-approved in the trusted base policy
• reject glob, absolute, traversal, backslash, and non-normalized approvals
• stage a one-shot four-path approval and 3000-line cap for the already-disabled duplicate PR reviewer cleanup

The follow-up cleanup PR removes the temporary approval list and restores the 2000-line limit. This does not bypass the gate: approval must exist on protected main before a deletion PR is evaluated.

Tests-first evidence

• focused gate suite failed on the exact base because an approved deletion was still blocked
• focused gate suite now passes: 7 passed, 4 subtests passed

Verification

• Ruff
• full pytest: 640 passed, 1 skipped, 54 subtests passed
• actionlint
• proxy Node tests: 13 passed
• dashboard Node tests: 15 passed
• JSON validation and diff-check

Boundaries

• no required-check, ruleset, protection, permission, secret, OIDC, VPS, or deploy mutation
• no provider/data/trading/live action

[Pigbibi]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a4ab14f497

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Pigbibi]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: 994c296d0a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".