onsite-applylisted

# Apply approved changes (the gate lives here) 1. Read profile + env file. Poll the channel first if telegram, via `core.approval.process_telegram_decisions(root, token, chat_id)` - it persists the poll offset and tolerates unknown/stale ids without raising. 2. List approved onpage-fix items. For each: a. `require_approved(path)` - this raises on anything not approved. Never catch that error to proceed; report it and skip. b. `snapshot()` the post (title + meta + content if the proposal touches it) -> save to `outcomes/<item-id>-rollback.json` in the brain repo. c. Apply via the CMS adapter (`onsite.cms.adapter_for`; wordpress or git-static per `cms.type` - the git-static branch below replaces steps b-g): `update_seo_meta` / `update_post` per the proposal body. (`update_rankmath` remains as the WordPress adapter's alias for `update_seo_meta`.) d. Verify: `get_rendered_head(target_url)` - assert the new title/description appear in the rendered head. On mismatch: `rollback()` immediately, then `PYTHONPATH="$CLAUDE_PLUGIN_ROOT/lib" python3 -m core status <item-path> failed --actor agent`, append a signal "apply-verify failed", and alert. Never leave the item approved. e. `PYTHONPATH="$CLAUDE_PLUGIN_ROOT/lib" python3 -m core status <item-path> applied --actor agent`; write an outcome record `outcomes/<item-id>.md`: what changed, when, rollback file, measurement due date