Approve an awaiting-approval sweep against an exact manifest digest.

This bernayser:write operation is the only API route into approved and costs no run quota itself. The store compare-and-set accepts only awaiting_approval; any other state returns validation_error, and unknown or foreign ids are not_found. Fix the manifest or state before retrying; for transient rate_limited or service_unavailable, wait retry_after_sec. Requires the explicitly minted bernayser:write scope; bernayser:read permits safe projections and bernayser:write permits mutations. This BERNAYSER operation is quota-neutral. While dark it returns not_found, and a valid key without the required scope receives scope_missing. Fix a non-retryable request or credential before retrying; for rate_limited or service_unavailable, wait for retry_after_sec and retry once.