feat(go): add approval chain parity

[carloshvp]

Summary

• add Go SDK approval-chain protocol objects, action binding digests, and a fail-closed coordinator for require_approval
• add a versioned webhook approval transport that validates request/action binding echoes and requires verified approver identity for allow responses
• wire AgentMeshClient to optionally route require_approval decisions through an approval coordinator
• document the new Go approval-chain surface

Scope

This is the Go SDK slice for #3083. TypeScript already has a separate parity PR in flight, so this PR keeps the language scope to agent-governance-golang/.

Validation

• /tmp/codex-go1.25.11/go/bin/gofmt -w agent-governance-golang/packages/agentmesh/approval.go agent-governance-golang/packages/agentmesh/approval_test.go agent-governance-golang/packages/agentmesh/client.go agent-governance-golang/packages/agentmesh/types.go
• /tmp/codex-go1.25.11/go/bin/go test ./... from agent-governance-golang/

[github-actions]

PR Review Summary

Check	Status	Details
🔍 Code Review	⚠️ Missing	No current-run comment
🛡️ Security Scan	⚠️ Missing	No current-run comment
🔄 Breaking Changes	⚠️ Missing	No current-run comment
📝 Docs Sync	⚠️ Missing	No current-run comment
🧪 Test Coverage	⚠️ Missing	No current-run comment

Verdict: ⚠️ AI review incomplete; ready for human review

AI review comments are untrusted advisory output. The summary reports workflow-generated completion status only, not model-authored pass/fail claims.