feat: plan 16 P1 complete (SEC-07 approval + SEC-10 agent identity)

- SEC-07 (M-08): real approval verification via approval-verify.sh in enforced mode
  (CASAN_PROFILE=prod / CASAN_APPROVAL_STRICT=1) for control-plane `set` (sensitive
  keys), kill-switch `clear`, and self-improve (inherits control-plane). A bare or
  forged approval string is now denied; dev mode stays backward-compatible.
- SEC-10 (M-05): non-spoofable agent identity. tool-registry-gate least-privilege no
  longer trusts CASAN_AGENT env in enforced mode (CASAN_IDENTITY_STRICT=1) — the
  caller must present a signed token (agent-identity-sign.sh) bound to agent id +
  run id, verified against agent-identities.registry. Blocks env spoofing + replay.

Verify: SEC+integrity gate 18/0, run-casan4 0-FAIL, adversarial 44/44 (H2 intact),
control-plane 9/0, h5-approval 12/0, c7-incident 15/0, self-improve 7/0, track-c 29/0.

Plan-16 P0 + P1 now complete; remaining: P2 (SEC-12/13/14/15/22..30).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

AINative_OKR_CASAN5/.specify/scripts/bash/control-plane-settings.py

@@ -187,14 +187,51 @@ def verify_signature(store):
     return ("signed", "ok") if res.returncode == 0 else ("invalid", "signature verify failed")
 
 
+def _approval_enforced() -> bool:
+    return os.environ.get("CASAN_PROFILE") == "prod" or os.environ.get("CASAN_APPROVAL_STRICT") == "1"
+
+
+def check_approval(key, actor, approval):
+    """SEC-07 (M-08): a security-sensitive setting change needs a REAL approval.
+    Dev (default) keeps the backward-compatible "any non-empty --approval" gate;
+    enforced mode requires a REGISTERED reviewer to cryptographically sign this
+    change (verified by approval-verify.sh), so a bare string can no longer approve.
+    Env contract mirrors governance-check: CASAN_APPROVER + CASAN_APPROVAL_SIG (or
+    CASAN_APPROVAL_JWT). The signed assertion is bound to the key being changed."""
+    if not _approval_enforced():
+        return bool((approval or "").strip()), "dev_nonstrict"
+    approver = os.environ.get("CASAN_APPROVER", "")
+    if not approver:
+        return False, "no_registered_approver"
+    verifier = os.path.join(os.path.dirname(__file__), "approval-verify.sh")
+    if not os.path.isfile(verifier):
+        return False, "approval_verifier_missing"
+    import tempfile
+    fd, inp = tempfile.mkstemp(suffix=".approval-input")
+    try:
+        with os.fdopen(fd, "w", encoding="utf-8") as fh:
+            fh.write(key)  # the approval is bound to the key under change
+        sig = os.environ.get("CASAN_APPROVAL_SIG", "-")
+        rc = subprocess.run(["bash", verifier, "policy_change", actor, inp, approver, sig],
+                            capture_output=True).returncode
+    finally:
+        try:
+            os.unlink(inp)
+        except OSError:
+            pass
+    return rc == 0, f"approval_verify_rc={rc}"
+
+
 def do_set(key, value, actor, reason, approval):
     policy = SETTINGS_POLICY.get(key)
     if policy is None:
         print(f"SETTING_NOT_ALLOWED {key}", file=sys.stderr)
         return 2
-    if policy["securitySensitive"] and not (approval or "").strip():
-        print(f"APPROVAL_REQUIRED {key}", file=sys.stderr)
-        return 3
+    if policy["securitySensitive"]:
+        ok, reason_ = check_approval(key, actor, approval)
+        if not ok:
+            print(f"APPROVAL_REQUIRED {key} ({reason_})", file=sys.stderr)
+            return 3
     with store_lock():  # SEC-19: atomic read-modify-write
         store = load_store()
         prev = store["settings"].get(key)