Class ApprovalApiClient

One decision fanned out over up to MAX_APPROVAL_BATCH_DECIDE records. Partial failure is IN the envelope (per-record ok/code), never an HTTP error — only batch-level problems (role, cap, malformed input) reject.

Mint a short-lived HMAC stream ticket for a live channel over the injected fetch (bearer-authenticated like every other call). The socket is opened by the injected StreamTransport — this method only fetches addressing, never a WebSocket. Errors surface as ApprovalApiError. For channel 'run', runId is required by the server (400 otherwise); passing workflowId lets the server return the fully-qualified run WS url so the caller need not rebuild the /api/stream/run/:wf/:runId path (which would duplicate the route shape).