feat(api): Phase 16 R4.2 抽取 ApprovalExecutionService

Strangler Fig Pattern: 從 approvals.py 抽取執行編排邏輯

新增:
- src/services/approval_execution.py (271 行)
- ApprovalExecutionService class
- 整合 OperationParser + Executor + Timeline + Notifications

瘦身成果:
- approvals.py: 1097 → 787 行 (-310 行)
- R4 總計: 移除 310 行內嵌業務邏輯

CI/CD 修復:
- 移除危險的 rm -f ~/actions-runner-* 指令
- 改用 checkout clean: true + workspace 內清理

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.github/workflows/cd.yaml

@@ -55,12 +55,6 @@ jobs:
     runs-on: [self-hosted, harbor, k8s]
     timeout-minutes: 1
     steps:
-      # Phase 16: 清理 Runner diag logs 避免 "file already exists" 錯誤
-      - name: Clean runner diag logs
-        run: |
-          rm -f ~/actions-runner-awoooi/_diag/pages/*.log 2>/dev/null || true
-          rm -f ~/actions-runner-awoooi-2/_diag/pages/*.log 2>/dev/null || true
-
       - name: "Check Required Secrets"
         run: |
           MISSING=""

.github/workflows/ci.yaml

@@ -31,12 +31,6 @@ jobs:
     runs-on: [self-hosted, harbor, k8s]
     timeout-minutes: 1
     steps:
-      # Phase 16: 清理 Runner diag logs 避免 "file already exists" 錯誤
-      - name: Clean runner diag logs
-        run: |
-          rm -f ~/actions-runner-awoooi/_diag/pages/*.log 2>/dev/null || true
-          rm -f ~/actions-runner-awoooi-2/_diag/pages/*.log 2>/dev/null || true
-
       - name: Quick sanity check
         run: |
           echo "✅ Runner 可用"
@@ -50,13 +44,14 @@ jobs:
     needs: pre-flight
     timeout-minutes: 10
     steps:
-      - name: Clean worktrees
-        run: rm -rf .claude/worktrees 2>/dev/null || true
-
       - uses: actions/checkout@v4
         with:
           clean: true
 
+      # 清理 worktrees (在 checkout 後，確保在 workspace 內)
+      - name: Clean worktrees
+        run: rm -rf ${{ github.workspace }}/.claude/worktrees 2>/dev/null || true
+
       - name: Setup pnpm
         uses: pnpm/action-setup@v3
         with: