feat(durable): list, read, and decide durable approvals

[subnetmarco]

Change

List, read, and decide durable approvals from Ruby. Tracks https://github.com/Kong/volcano-hosting/pull/1678.

• client.durable.approvals: list(project_id, filters), get, stats(function:, from:, to:), approve(..., comment:), deny(..., comment:), returning frozen Data records. A decider with an empty email is accepted, and a string window bound must carry an offset (Z or ±hh:mm), since one without would be read in the host's time zone.
• HTTP 403 now raises Volcano::Error::PermissionDeniedError, a subclass of AuthenticationError, so existing rescue AuthenticationError still catches it. A project access token deciding an approval gets this error.
• Ruby has no durable authoring, so there is no wait_for_approval; workflows request approvals from JavaScript or Python.
• Generated client synced from Hosting's OpenAPI.
• Steep 2.1 (from main) flagged an unreachable branch in a type fixture; it now checks by identity.

Verification

• bundle exec rake quality: pass. Audit, generated client check, RuboCop (no offenses), Steep (both configurations), 2020 examples with 100% line and branch coverage, all injected defects detected, package smoke, documented quickstart.

Cross-language impact

Classify this change: public facade / wire contract / shared behavior.

• Requirement IDs and affected behavior: SDK-DURABLE-005 to SDK-DURABLE-010. Ruby's binding covers list, stats, approve, deny, the project-token refusal, and repeated and conflicting decisions; the waiting workflow is written in JavaScript.
• JavaScript / Python / Ruby companion PRs: feat(durable): add waitForApproval and the approvals client volcano-sdk-js#315, feat(durable): add wait_for_approval and the approvals client volcano-sdk-python#389.
• Canonical scenarios, bindings and active/staged copies: tests/sdk-contract/features/durable-approvals.feature with JS, Python, and Ruby bindings in https://github.com/Kong/volcano-hosting/pull/1678.
• Public examples updated in each affected language: README.md and docs/functions.md here; JS and Python in their PRs.
• Native checks and shared acceptance evidence: native checks above at this branch's head. Live acceptance runs in Hosting's staging validation after Hosting deploys approvals; not run yet.

Merge order

1. SDK releases: a maintainer merges and releases the JS SDK 1.16 (feat(durable): add waitForApproval and the approvals client volcano-sdk-js#315), Python SDK 0.14 (feat(durable): add wait_for_approval and the approvals client volcano-sdk-python#389), and the Ruby SDK (feat(durable): list, read, and decide durable approvals #341). Hosting's E2E fixtures install those versions from the registries. Until Hosting deploys, the new approval methods get 404.
2. CLI (feat(durable): add durable approvals commands volcano-cli#282), with a one-time maintainer override of localmode-e2e. That suite needs a nightly local-mode image with approvals, which exists only once Hosting merges. Hosting's merge queue runs its CLI E2E against CLI main, so the CLI goes first.
3. Hosting (https://github.com/Kong/volcano-hosting/pull/1678).
4. Dashboard (https://github.com/Kong/volcano-web/pull/836, https://github.com/Kong/volcano-web/pull/837, then https://github.com/Kong/volcano-web/pull/832) and agent skills (docs(durable): teach agents to request and decide durable approvals volcano-skills#57).

[subnetmarco]

Reviewed at 561e1a3. I found no P1 or P2 issues:

• Mapping 403 to PermissionDeniedError < AuthenticationError is backward compatible. 403 used to raise AuthenticationError, nothing compares exact error classes, and the refresh paths still key on 401.
• The OpenAPI matches Hosting's bundle, and query names, enums, conflict codes, and pagination all match.
• The records are frozen all the way down, and the RBS signatures match the implementation.
• rubocop, Steep, and the approval specs pass.

Two P3s inline.