feat(teams): add task approval workflow with approve/reject actions

Tasks can be created with require_approval flag, starting in
pending_approval status. Users approve/reject via tool actions or
WS methods. Approval respects blocked_by dependencies — tasks with
unresolved blockers transition to blocked instead of pending.
Delegate agents are restricted from approving/rejecting.

pkg/protocol/events.go

@@ -43,6 +43,8 @@ const (
 	// Team task lifecycle events.
 	EventTeamTaskClaimed   = "team.task.claimed"
 	EventTeamTaskCancelled = "team.task.cancelled"
+	EventTeamTaskApproved  = "team.task.approved"
+	EventTeamTaskRejected  = "team.task.rejected"
 
 	// Team CRUD events (admin operations).
 	EventTeamCreated       = "team.created"

pkg/protocol/methods.go

@@ -107,6 +107,8 @@ const (
 	MethodTeamsGet      = "teams.get"
 	MethodTeamsDelete   = "teams.delete"
 	MethodTeamsTaskList      = "teams.tasks.list"
+	MethodTeamsTaskApprove   = "teams.tasks.approve"
+	MethodTeamsTaskReject    = "teams.tasks.reject"
 	MethodTeamsMembersAdd    = "teams.members.add"
 	MethodTeamsMembersRemove = "teams.members.remove"
 	MethodTeamsUpdate        = "teams.update"

pkg/protocol/team_events.go

@@ -103,7 +103,7 @@ type QualityGateRetryPayload struct {
 }
 
 // TeamTaskEventPayload is the typed payload for team task lifecycle events
-// (created, claimed, completed, cancelled).
+// (created, claimed, completed, cancelled, approved, rejected).
 type TeamTaskEventPayload struct {
 	TeamID           string `json:"team_id"`
 	TaskID           string `json:"task_id"`