Approve a held draft — it goes out now, without re-signing

Scope approve:holds. The first decision wins: a second call answers 409 already_decided with the decision. Recipients that entered a suppression list while the draft waited are skipped (listed in skipped); if none can go out, 409 release_failed and the draft stays pending. The recipient domains are checked now, after the decision — a draft held by an approval policy skipped that DNS check at send time, so the agent cannot leak data through the lookup: a domain that does not receive mail answers 422 invalid_recipient_domain (with recipient), and the draft is closed as rejected by system:recipient-domain, nothing goes out and the quota is refunded. Counts warm-up like any outbound mail.