[Feature Request] Inbox approval-item expiry (TTL) for all approval kinds

[cagdasyurekli]

Problem

Pending approvals in the inbox have no expiry (coworker/inbox.py) — an approval can sit indefinitely, and the agent suspends forever waiting on it. #463 raises this only for a future PHYSICAL risk class (IoT actuation); this request generalizes it to every approval kind. Approving a "send this email" or "merge this PR" three hours late is also acting on stale consent context.

Proposed Solution

1. Add an optional per-item expires_at TTL, honored at resolve time: expired items auto-resolve as expired, surfaced to the user and written to the audit trail.
2. Add a default TTL for unattended/parked approvals, configurable in settings.
3. When an item expires, release the suspending agent (the turn resumes with an "approval lapsed" notice rather than hanging forever).

Implementation Scope & Alignment

• Scope: ~100-150 lines in coworker/inbox.py + engine.py + settings.
• Zero New Dependencies.
• Alignment: Governance — user consent should not be valid indefinitely; an unattended run should not wedge permanently on an approval nobody will answer.