Fix mirrored approval resolution

[teempai]

What changed

• refresh laptop-owned approval state independently from transcript synchronization on iOS and macOS
• treat decisions already completed by the other client as a successful mirrored resolution
• return explicit expired, already-resolved, and provider-delivery error codes instead of generic failures
• stop provider turns whose recorded approval decision cannot be delivered
• migrate legacy Mac approval keys from biometric-only access to Secure Enclave user presence, enabling Touch ID or Mac-password fallback
• repair only the local Mac approval identity after successful user-presence signing; phone pairing and canonical context remain unchanged

Why this request was shown

The enrolled working directory was /Users/teemupaivinen/claudecode_codex, while the provider requested a find rooted at /Users/teemupaivinen. That is broader authority and correctly requires an approval.

Verification

• npm run typecheck
• npm run build
• npm test (299 passing)
• swift test --package-path native (55 passing)
• unsigned EXARCHMac build for generic macOS
• unsigned EXARCH build for generic iOS Simulator
• git diff --check