… promote CLI + alert fallback + envelope auto-approve

Deliverable A — Wider-suite test stability:
* Audited missing-deps blocker: all the deps CC#1 has been
  flagging across the last several PRs (aiosmtplib, prompt_toolkit,
  aioimaplib, fire, openai) are ALREADY declared in
  ``pyproject.toml`` core / dev extras. The gap was env-side, not
  code-side — CC#1's dev environment hadn't been re-synced after
  the dep additions across recent buckets.
* Resolution: ``uv pip install -e ".[all,dev]"`` (already
  documented in CONTRIBUTING.md). With the deps installed:
  - Collection: 7008 tests (was 7004 collected + 4 collection
    errors on un-synced env)
  - Full suite under hermetic env: **6905 passed / 94 failed /
    10 skipped** in 83s
  - Sub-suite excluding reasoning + gateway: **6605 passed /
    24 failed / 10 skipped** in 80s
* Note: the 94 remaining failures are PRE-EXISTING (verified by
  ``git stash`` + re-run on the merge commit before this PR).
  They cluster in:
  - ``reasoning/test_anthropic_engine*.py`` (~53) — gateway-route-
    through mock isolation issue introduced by CC#3's #196
    daemon Phase 1 default-flip; tests call real Anthropic API
    via the route-through path even though they pass a mock
    client.
  - ``test_backup.py`` / ``test_config.py`` / ``test_cron.py`` /
    ``test_web_server.py`` (~30) — HERMES_HOME → KORA_HOME
    migration tests stamping legacy expectations.
  - ``test_kanban*.py`` (~4) — separate flaky area.
  Per the bucket spec STOP-ASK §4: these need a separate
  stabilization bucket; this one completes with the deps-side
  resolved. PR description carries the recommended bucket title.

Deliverable B — ``kora promote`` operator CLI commands:
* New module ``kora_cli/promote_cli.py`` with 4 subcommands:
  - ``kora promote status`` — per-loop pending / approved /
    rejected / expired counts + last activity timestamp across
    all 6 loops.
  - ``kora promote run-once <loop>`` — invoke one cycle ad-hoc;
    returns the loop's cycle summary dict.
  - ``kora promote history <loop> [--days N]`` — recent audit
    rows for the loop, filtered to the per-loop seam vocabulary
    and (where the seam is shared like ``promotion.approved``)
    scoped via the ``promotion:<loop>:`` caller_session_id prefix.
  - ``kora promote pending <loop>`` — JSON dump of currently-
    pending proposals; ordered highest-confidence first.
* Snapshot-expand's audit-only layout (no pending/approved/
  rejected) gets special-cased — ``pending`` errors with a clear
  redirect to ``history``; ``status`` surfaces applied-record
  counts only.
* Registered under main.py's existing subparser pattern; cycle
  imports are LAZY so ``kora promote --help`` doesn't pull the
  clustering / pricing chain.

Deliverable C — Alert investigation fallback DM polish:
* The mechanism shipped in #197 (fallback DM on reasoning failure
  via ``append_outbound_log_entry`` + dm_status=
  ``engine_unavailable_fallback`` in the audit). KR-CC1-POLISH
  improves the wording:
  - Header now surfaces ``category (severity): alert id N
    (via {channel})``
  - Footer is explicit: "Kora is unavailable to investigate this
    alert ... Review the alerts panel and act manually — Kora
    will not retry this investigation."
* New test asserts dm_status exactly ==
  ``"engine_unavailable_fallback"`` on the engine-None path; CC#2's
  KR-FE-ALERT-INVESTIGATIONS-VIEWER reads that enum value.

Deliverable D — Probe-fix-envelope auto-approve (low-risk):
* New env: ``KORA_PROMOTE_PROBE_FIX_AUTO_APPROVE_LOW_RISK``
  (default ``false``; operator opts in).
* New env: ``KORA_PROMOTE_PROBE_FIX_AUTO_APPROVE_WAIT_HOURS``
  (default ``1.0``).
* New module ``kora_cli/promote/probe_fix_envelopes/auto_approve.py``
  with ``run_auto_approve_sweep`` — runs at end of each
  probe-fix-envelope cycle, walks pending proposals, auto-
  approves those whose ``blast_radius_level == "low"`` AND have
  been pending ≥ wait_hours. Approval = transition to
  ``approved/`` + emit ``promotion.probe_envelope_action_auto_approved``
  audit row.
* New ``ProbeEnvelopeProposal.blast_radius_level`` field
  (``"low" | "medium" | "high"``); default ``"high"`` preserves
  the existing operator-must-review posture. Backwards-compat:
  legacy on-disk payloads without the field rehydrate to
  ``"high"`` via the new ``proposal_from_dict`` helper.
* Heuristic in ``_derive_blast_radius_level`` returns ``"low"``
  ONLY for known-narrow envelope patterns
  (``_KNOWN_LOW_RISK_PATTERNS`` — currently the fly
  restart_unhealthy_machine envelope's (probe, issue_category)
  pairs). Everything else defaults to ``"high"``. The heuristic
  intentionally undershoots — false-low classifications would
  let proposals slip through to operator's envelope without
  review.
* CRITICAL — two-tier gating preserved (documented inline +
  in the auto_approve module docstring):
  1. Auto-approve → "this is in our envelope vocabulary"
  2. Per-probe ``KORA_PROBE_AUTOFIX_<NAME>_ENABLED`` →
     "Kora is permitted to invoke it at runtime"
  The auto-approve flag DOES NOT cause Kora to execute the
  fix — only adds it to the vocabulary; operator still enables
  the per-probe ENABLED env separately to authorize execution.
* New audit seam ``promotion.probe_envelope_action_auto_approved``
  extending SeamName Literal with the auto_approve_wait_hours +
  auto_approved_at fields for operator timeline reconstruction.

Tests:
* 12 new tests for the probe-fix-envelope auto-approve sweep
  (heuristic / fixture-backed rehydration / sweep disabled by
  default / wait-window enforcement / high-risk never approves /
  audit payload shape).
* 13 new tests for ``kora promote`` CLI commands (status / pending
  / history / run-once dispatch / loop allowlist / snapshot_expand
  special-case error / cross-loop history caller_session_id
  filtering).
* 2 new tests for alert fallback DM polish (wording assertion +
  dm_status enum assertion).
* All 41 new tests pass; all relevant existing tests still pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>