[Skeyelab]

Closes #57.

What

Pipelines waiting at a manual approval can now be approved or rejected from aws-green.

• Token capture - ActionData.ApprovalToken is read from the GetPipelineState call we already make each poll (only while the action is InProgress). No new API calls. Parsing is factored into PipelineDataFromState so it is unit-testable.
• ⏸ Stoplight - new StoplightAwaitingApproval, ranked between yellow and red, raised in state.FromData from the token. Sorts to the top of the dashboard; stage and action rows show a magenta ⏸ and the a / x hint.
• a / x keys - fix.PlanApproval builds an approve/reject plan, confirmed with the existing enter/esc flow. PutApprovalResult is sent with a fixed summary (Approved via aws-green / Rejected via aws-green). The smart fix (f) never approves.
• Stale tokens - InvalidApprovalTokenException / ApprovalAlreadyCompletedException map to ErrApprovalAlreadyDecided, shown as "already decided elsewhere - refreshing" and followed by a re-poll.
• Read-only profiles - AccessDenied* maps to ErrApprovalNotPermitted, shown as "profile X can't approve - it needs codepipeline:PutApprovalResult".
• Stuck alerts - a pipeline awaiting approval no longer fires pipeline_stuck. A failed stage still alerts even with an approval open (stage statuses can come from different executions).
• Docs - README (feature, keybinding, IAM permission, stuck-alert note), help overlay, and CONTEXT.md (resolves the open "manual approval" ambiguity).

Decisions from #57's open questions

Question	Decision
Stoplight state	New ⏸ state
Keybinding	Dedicated a / x
Summary	Fixed default text
Stuck alerts	Exempt while awaiting approval

Testing

• Unit tests for token extraction, pending-approval state, planning/execution, error mapping, stuck exemption and ordering, and dashboard keys/rendering. go test ./... and golangci-lint clean.
• Live: approved a waiting pipeline in testlibnd (AdministratorAccess). In libnd via the read-only libnd-view profile, the approval shows as ⏸ but cannot be decided, which is what the new access-denied message covers.