Ledger approval hardening follow-ups #76

These items from the security re-review of #73 (#73 (comment)) were left out of that PR.

• Message-type dialogs. For dialogs answered by message (responseCapability: "message"), rolling back the run that delivered the answer doesn't withdraw the approval. Only the run that asked the question is watched.
• Question drift. If a pending dialog's question changes before Chris answers, the answer is quoted against the text the server holds at answer time. Have the client send a hash of the question text it showed, and refuse a mismatch.
• Accidental answers. Digit-key shortcuts can answer a dialog by accident. Require an explicit confirm when the question has a Ledger key: line.

Already done in #73: approvals are withdrawn when the source thread is deleted.

Ledger key: r3/ledger-verified-approvals.

🤖 Generated with Claude Code