feat: auto-approve MR/PR on clean review

[brucearctor]

Context

When the review produces 0 findings, optionally approve the MR/PR.

• GitLab: POST /projects/:id/merge_requests/:iid/approve
• GitHub: POST /repos/:owner/:repo/pulls/:number/reviews { event: "APPROVE" }

Safety Guards (E9 requirement)

Auto-approve MUST require ALL of:

1. 0 findings
2. Model actually reviewed >0 files
3. No truncation detected (token limit not hit)

Without these guards, auto-approve is a rubber stamp on model failures.

Interface Design

Use interface segregation — VCSApprover interface, type-assert at call site:

type VCSApprover interface {
    ApproveReview(ctx, projectID, mrIID string) error
}
// if approver, ok := client.(VCSApprover); ok { ... }

Config

• Flag: --auto-approve (default: false)
• YAML: auto_approve: true

Ref

E9 design session in conversation 8ecd8c13