feat: apply reviewed goal patches

packages/casan-control-panel/README.md

@@ -45,9 +45,13 @@ Goal workspace context:
 - `POST /api/v1/goals` requires `{ goal, projectId }`. H1 resolves the registry again,
   produces a size-limited redacted manifest/snapshot, and gives the exact same snapshot to
   local and cloud models. Account-model CLIs remain inside an empty temporary sandbox.
-- Goals requesting workspace side effects create a tenant-scoped
-  `goal.workspace.execute` approval proposal and finish as `requires_approval`; this flow
-  does not write source files or execute a coding action.
+- Goals requesting workspace side effects make the producer and reviewer return a unified
+  patch. CASAN validates its paths and preconditions, stores it as a tenant-scoped artifact,
+  creates a `goal.workspace.execute` proposal, and finishes as `requires_approval` without
+  modifying source files.
+- `POST /api/v1/goals/:id/apply` accepts only a patch whose proposal is already approved by
+  a different actor. The executor verifies the artifact hash, applies it, runs fixed
+  project build/test commands, and reverses the patch if verification fails.
 
 Local management headers: `x-casan-actor`, `x-casan-role`, `x-casan-project`,
 `x-casan-tenant`. Missing role defaults to `viewer`, so writes fail closed.