feat(h5): approval-identity MVP — signed reviewer approvals (C4/V20)

Under CASAN_APPROVAL_STRICT=1, a high-risk approval is trusted ONLY when a
REGISTERED reviewer cryptographically signs THIS exact request and their role is
authorized for the action — a plain env-var CASAN_APPROVER is no longer enough.

- approval-sign.sh: reviewer signs assertion
  "casan-approval|v1|<action>|<actor>|<input_sha256>|<approver_id>" with their key.
- approval-verify.sh: gate looks up reviewer role+pubkey in reviewers.registry,
  enforces role→action authorization, verifies the RSA signature (fail-closed).
- governance-check.sh: strict branch requires a valid signed approval; SoD still
  enforced; default (non-strict) env-var path UNCHANGED (baseline preserved).
- reviewers.registry: role-scoped reviewer identity registry (pubkeys off-repo;
  production replaces with OIDC/JWT from a real IdP).
- phase-h5-approval-tests.sh: 8 checks — valid/authorized approve; unsigned,
  wrong-role, forged-key, unregistered, replay-to-other-request, self-approval
  all denied; non-strict backward-compat.

Baselines: run-casan4 35/35, adversarial 44/44. Lifts H5 policy-approval (C4)
2.5 -> ~3.5-4 / 5. Total suites now 6 (+8 checks = 148).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

AINative_OKR_CASAN5/.specify/level5/central-governance/reviewers.registry

@@ -0,0 +1,28 @@
+# CASAN H5 — Reviewer identity registry (Approval-identity MVP · C4).
+#
+# Binds an approver id to a ROLE and a PUBLIC key. Under CASAN_APPROVAL_STRICT=1,
+# governance-check.sh trusts an approval ONLY if it is signed by the private key
+# matching one of these public keys, and the reviewer's role is authorized for
+# the action (see the `action` lines).
+#
+# Line format (no yaml dependency):
+#   reviewer <id> <role> <pubkey-file>          # pubkey-file relative to reviewers/ dir
+#   action   <action-name|default> <comma,roles>
+#
+# Reviewer PRIVATE keys live OFF-REPO (with the reviewer / issued by an IdP) —
+# only PUBLIC keys are provisioned here, same policy as the audit signing key.
+# Production: replace this static registry + local pubkeys with OIDC/JWT identity
+# from a real IdP (verify token signature + role/exp claims).
+
+reviewer security-lead   security       security-lead.pub.pem
+reviewer tech-lead       tech_lead      tech-lead.pub.pem
+reviewer ops-owner       ops            ops-owner.pub.pem
+reviewer project-owner   project_owner  project-owner.pub.pem
+
+# Which role may approve which action class.
+action deploy      ops,security
+action migration   tech_lead,security
+action db_write    tech_lead,security
+action write_code  tech_lead,security
+action policy_change security
+action default     tech_lead,ops,security,project_owner