Close child (relay): merge the approval-alert epic #441

Close child of #439 (epic barelyworkingcode/eve#498). Closed by relay's sync PR.

User story

As the owner, I want relay's half of the approval-alert epic merged only after its checks pass, so that main never holds half of it.

Acceptance criteria

• CI is green on the final commit of epic/439-approval-alert, with a dispatched ci run on that head.
• Send the approval alert to the phone over APNs, with the key and device tokens sealed in relay #440 is merged to the epic branch with review and evidence lines.
• main is merged into epic/439-approval-alert by the sync PR sync/439-main, which says Closes #441.
• relay's Full verify passes from relay main after the merge.

What I'd notice

Nothing. The change appears on main in one step.

Close lines

1. CI green on the final commit of epic/439-approval-alert, and a full run: dispatch ci (workflow_dispatch) on the epic head, after line 4.
2. The Full run passes. relay's harness accepts only a clean main, so its run is after the merge (joint close task, step d, on Alert the owner's phone when a session waits for approval eve#498).
3. Every child is merged to the epic branch, with review and evidence lines in place.
4. main is merged into the epic branch by a sync PR sync/439-main whose body says Closes #441; conflicts are resolved on it.
5. Close each child but this one with a comment naming its PR (joint close task).
6. merge-check passes on relay's epic PR to main (joint close task, step c).
7. Merge the epic PR; its Closes #441 closes this child. Confirm main still green, close Epic: deliver the approval alert to the phone (relay side of eve#498) #439, delete the epic branch.

Tasks

• Open relay's draft epic PR (epic/439-approval-alert → main, body Closes #441) when Send the approval alert to the phone over APNs, with the key and device tokens sealed in relay #440 merges.
• Line 3, then line 4 (sync/439-main), then line 1 on the head line 4 leaves.
• Report lines 1, 3 and 4 on Alert the owner's phone when a session waits for approval eve#498 (joint close step a).
• Lines 5 to 7 and line 2 at joint close steps c and d.

Contract

Joint close task and order: barelyworkingcode/eve#498. This child adds no code. Its PRs are the sync PR sync/439-main and relay's epic PR to main (body Closes #441). merge-check judges both on the files that differ from main, so this list is the union of #440's paths; conflict resolution stays inside them.

File ownership

• internal/push/
• cmd/relay/push_*.go
• cmd/relay/apns_release.go
• cmd/relay/apns_relaytest.go
• cmd/relay/frontend_server.go
• cmd/relay/cli_verbs.go
• cmd/relay/admin_ops.go
• cmd/relay/server_core.go
• internal/presence/presence.go
• internal/config/settings.go
• internal/config/seal.go
• internal/sessions/permission/permission.go
• internal/sessions/session/attention.go
• internal/sessions/attention/board.go
• internal/sessions/api/ws_session.go
• internal/sessions/api/ws.go
• fakerelay/internal/api/push.go
• fakerelay/internal/api/register.go
• fakerelay/internal/state/state.go
• fakerelay/internal/sessions/session.go
• fakerelay/internal/sessions/hub.go
• fakerelay/prooftest/push_test.go
• e2e/features/g1_push_alert_test.go
• e2e/fakes/fakeapns/
• docs/push.md
• docs/routes.md
• docs/cli.md
• docs/events.md
• docs/session-host.md
• docs/presence-gate.md
• docs/tokens.md
• docs/fakerelay.md
• docs/FEATURES.md

Test surface

The dispatched ci run (every e2e feature test and fakerelay proof test, not the diff's selection), and relay's Full verify at step d. Nothing new is written here.

Waits

• ci: the dispatched run's id, waited on with gh run watch <id> --exit-status (a completion handle), never a duration.
• Step d: the devboxverify run's done-file, waited on with a background command.
• Merges: merge-check exit codes.

Budget

0 lines of new code. Conflict resolution only inside the paths above; anything else stops and asks.