Record metadata reviews from the headless cloud planner

[seonghobae]

Summary

• add an explicit headless review action bound to both the candidate metadata fingerprint and the current destination-specific review fingerprint
• persist approved or held decisions through the existing immutable review store
• let copy actions load the latest review decision from an explicit absolute review directory and pass it through the existing stale/tamper/held gate
• keep review, copy, attestation, and root-list actions mutually exclusive

Why

The planner already exposed metadata evidence but a headless user could not record or consume the required review decision. A decision made for iCloud also cannot be reused for OneDrive because the destination is part of the review fingerprint.

Live metadata-first proof

• PDF production date came from embedded ExifTool CreateDate (2026-04-17), not the filename
• embedded author and scanner metadata were inspected; the only review reason was a bounded pdfinfo timeout
• an exact OneDrive-bound approval was written, then a fresh plan copied 103,544,637 bytes
• receipt SHA-256 and BLAKE3 matched the source and destination
• PR Attest third-party File Provider uploads natively #32 native File Provider attestation returned sync_complete=true and a provider-native local-eviction permit with no blockers
• the source remains present; this PR exposes no deletion action

Validation

• cargo test --manifest-path src-tauri/Cargo.toml --locked --no-default-features --bin disksage-cloud-plan: 5 passed
• actual headless review, copy, and native attestation completed against the configured personal OneDrive root
• git diff --check

Stacked on #32.