Add approval evidence to milestone dry-runs

[StatPan]

Goal

Make gira milestone new|assign|plan --dry-run --json emit the shared gira-approval-plan/v1 approval evidence envelope so adapters can approve milestone creation and assignment mutations from a stable JSON contract.

Scope

• Add a stable milestone-report/v1 schema version to milestone JSON reports.
• Attach approval evidence to mutating milestone dry-runs: milestone new, milestone assign, and milestone plan.
• Reconstruct matching dry-run/apply commands from report fields, including repo, milestone, tickets, labels, state, limit, description, and due date where available.
• Keep read-only milestone list/status behavior compatible while allowing schema-versioned JSON.
• Update the agent-kernel adapter contract gap text after milestone dry-runs are covered.

Acceptance Criteria

• Milestone dry-run JSON includes schema_version: milestone-report/v1 and approval.schema_version: gira-approval-plan/v1.
• Approval evidence includes stable planned actions, blockers/warnings arrays, apply/dry-run commands, and post-apply verification.
• Apply JSON retains the schema version and omits dry-run approval evidence.
• Existing milestone text output and mutation behavior stay compatible.

Expected Delivery

Open one implementation PR with focused tests for core milestone report construction and CLI JSON output. Merge after checks pass.

Parent: #521

base_branch: main
base_source: branch_policy.default
branch_policy_mode: github-flow
target: default
work_branch: issue-623-add-approval-evidence-to-milestone-dry-runs

[StatPan]

Finish Receipt

• Finished at: 2026-05-23T06:54:11Z
• Ticket: Add approval evidence to milestone dry-runs #623 status=Done state=closed
• Linked PR: feat: Add approval evidence to milestone dry-runs #624 state=MERGED merged=true
• Checks: passed total=11 passing=11 pending=0 failing=0
• Review: unknown
• Evidence: closing_reference,branch_binding,checks
• AI Delivery Telemetry: not_required
• Label changes: add=status:done remove=status:in-review
• Warnings: missing_acceptance_criteria
• Next: ticket is done