Supervised tool loop

Propose a sandboxed summary-writing action, enforce an allowlist, replay a clearly identified approval fixture, execute the local tool, and verify its output and digest. Set AKOFLOW_APPROVAL_FILE to supply an explicit approval record; the bundled approval is only for this smoke example.