feat: replace polling with WS subscriptions + wire workflow approvals

[wesbillman]

Summary

• Replace REST polling with WebSocket subscriptions across 6 desktop feature areas for real-time reactivity
• Wire WF-08 workflow approval infrastructure so runs suspend at approval gates instead of failing
• Extract shared useReactiveSubscription hook to eliminate subscription boilerplate
• Add "Subscriptions, Not Polling" principle to AGENTS.md

Desktop polling → subscriptions

Feature	Before	After
Forum posts/threads	15s/10s poll	subscribeLive kinds 45001/45003 + 60s backstop
Workflow runs	1s poll (active)	subscribeLive kind 46010 + 10s backstop
Pulse timeline	30s poll	subscribeLive contact note events + 120s backstop
Channels list	60s poll	5min backstop (live updates already wired)
Agents/personas/teams	30s poll each	Removed — CRUD mutations invalidate cache
Home feed	30s poll	Kept at 30s (relay scoping prevents global subscriptions)

Note: Presence polling is handled separately in #434.

WF-08 workflow approvals

• executor.rs: create_approval() called with token, expiry, approver spec
• lib.rs: finalize_run sets WaitingApproval instead of Failed stub
• Trace entry pushed for suspended steps (UI renders approval card inline)
• Approver spec validated at creation (rejects unresolvable role specs)
• e2e test: full round-trip trigger → waiting_approval → grant → completed

Known limitations (pre-existing, documented)

• No background sweep for expired approval timeouts (runs stay in WaitingApproval)
• Role-based approver specs not yet supported (rejected at creation with clear error)
• Workflow subscription for kind:46010 is forward-looking (executor doesn't emit event yet; backstop poll handles it)

Test plan

• Desktop build passes (npm run build)
• Cargo build passes (cargo build --workspace)
• 143 workflow tests pass (cargo test -p sprout-workflow)
• e2e approval round-trip test passes (was #[ignore], now enabled)
• Pre-commit hooks pass (biome, cargo fmt, dart format)
• Manual: verify forum posts appear in real-time without page refresh
• Manual: verify workflow run status updates reactively
• Manual: verify approval card renders inline in run trace

🤖 Generated with Claude Code

[wesbillman]

closing for now, will revisit soon.