Hide stale Polymarket onboarding challenges

[0xdewy]

Summary

• Treat Polymarket onboarding approval challenges as actionable only while approval_challenge.json exists and approval.json does not
• Make lookup, read, and list agree so stale challenges disappear from the VFS projection after the foreground ceremony writes approval.json
• Keep the underlying sidecar files untouched for audit/recovery behavior

Closes #85

Checklist

• Tests added or updated for behavior changes: added wired_onboard_hides_challenge_after_approval_is_written
• Architecture docs (docs/architecture/) updated if contracts or behavior changed: N/A, no architecture contract changed
• Sealed Approval invariants respected (no signing outside a grant or bounded capability, no PRF/grant persistence, execution from sealed bytes) — see docs/architecture/Sealed Approvals.md: N/A, projection-only lifecycle change
• Agent Documentation updated (crates/bloom-vfs/src/docs/agent-guidance.md and affected Petal READMEs) — see docs/architecture/Agent-native Documentation.md: N/A, no user-facing command/documentation contract changed

Verification

• cargo fmt
• cargo test -p bloom-vfs wired_onboard_hides_challenge_after_approval_is_written -- --nocapture
• cargo test -p bloom-vfs wired_onboard_denies_and_writes_challenge_without_grant -- --nocapture
• cargo test -p bloom-vfs wired_onboard -- --nocapture
• cargo check -p bloom-vfs
• git diff --check