feat: approval reassignment — escalate to next admin or specific admin

[Copilot]

Approval requests were delivered to a single admin with no fallback. If that admin was unavailable, the request stalled indefinitely with no recourse.

Changes

DB

• Migration 019 adds notified_approver_ids TEXT (JSON array) to pending_approvals — tracks which admins have already received a card for a given approval.

Core approval logic (primitive.ts)

• pickApprovalDelivery() gains an optional exclude: string[] param; skips already-notified user IDs when picking the next target.
• requestApproval() now stamps the chosen recipient into notified_approver_ids on every new row.
• New reassignApproval({ approvalId, toUserId? }) function: re-delivers the card to the next eligible admin (skipping notified ones), or to an explicit --to target (validated to have admin privilege). Updates approver_user_id and extends notified_approver_ids atomically.

CLI — ncl approvals reassign

ncl approvals reassign --id <approval-id> [--to <user-id>]

Auto-picks the next un-notified admin in priority order (scoped admins → global admins → owners), or force-routes to a specific user. Errors clearly when all admins are exhausted or the explicit target lacks privilege.

Container MCP tool — reassign_approval

{ "action": "reassign_approval", "approval_id": "appr-...", "to_user_id": "telegram:123" }

Agent writes this to messages_out; the host picks it up via a registered delivery action. Cross-group attempts (approval belongs to a different agent group's session) are blocked at the host before calling reassignApproval.