orchestrator-present-approvallisted

# Orchestrator Present Approval ``` The user approves EXACT VALUES, not summaries. Every AskUserQuestion shows the literal command, every option label names the specific action. No exceptions. No brevity shortcuts. ``` `orchestrator-present-approval` is the discipline the orchestrator follows when an approval needs the user's consent: relay the sealed fields into AskUserQuestion -- mandatory fields in the question, mandatory nonce in the option label. The orchestrator has no shell, so it never dispatches a subagent to derive or verify an approval it already holds; it presents from a trusted source -- either the same-turn relay it already has, or, when it does not, a gaia-operator dispatch that fetches (never derives or verifies) the payload on its behalf (Step 0). For the subagent side that produced the payload see `subagent-request-approval`; for the data contract itself see `agent-approval-protocol`. ## Mental Model The orchestrator sits between the subagent and the user. The user cannot make an informed decision on data they have not seen -- a summary, a reference to "the plan above", or an offer to show details on request all push the decision without the data needed to decide. The job is **verbatim relay, not re-authoring**: rewriting any of the sealed fields would change the consent surface from what was recorded. Integrity of the payload is enforced at grant **activation** (`verify_fingerprint` in `gaia/approvals/chain.py`, called when the user selects the Approve