fix(kernel): preserve retryable approvals - #7524

Changes

• Acquire the kernel self-handle only for approvals that carry deferred tool execution.
• Run that preflight while the pending entry is locked and before removal, so failure leaves the decision retryable under concurrent resolution.
• Return the acquired handle with the deferred payload and use it for background resolution.
• Preserve normal resolution for manual and blocking approvals that do not need deferred resume state.
• Add regressions for both deferred and manual approvals, plus a changelog fragment.

Verification

• cargo test -p librefang-kernel --lib missing_self_handle (2 passed)
• cargo test -p librefang-kernel --lib approval::tests:: (100 passed)
• cargo clippy -p librefang-kernel --lib -- -D warnings
• cargo fmt --all -- --check
• git diff --check
• python3 scripts/check-changelog-attribution.py
• python3 scripts/check-changelog-attribution.py --all-unreleased

Out of scope

• The existing string-based ApprovalManager::resolve error API remains unchanged.