feat(discord): SetSpark record client for the Discord Sage, fixed verbs against setspark-api, connector-verified approvals (#1509)

Row 25, parts 2a and 2b, against the shared-signals contract a5425a2.

Model side: eight fixed verbs in the pi extension (record_list, record_get,
record_create, record_update, resolve_id, open_approval_request,
get_approval_request, create_document), each one HTTP call with arguments
checked before any request. Writes carry an idempotency key
<principal>:<message id>:<call index> and an audit context. The seat key is
read from a 0600 file on every call and never cached, printed or journaled.

Connector side: append-only approval ledger, Approve button and exact
"approve" reply resolved by the connector against the required approvers,
confirmation message posted as button evidence, bind and add_approval through
the service under connector keys, retry of unknown entries on start.

Evidence: node tests 162 pass, scripts/test-discord.sh 63/63. Review by
rev-code-02, round 1 approved (#1509 comment 26467, tree 7872d8c5).

Co-Authored-By: Claude Fable 5.1 <[email protected]>

agents/sage/DISCORD-USER.md

@@ -33,6 +33,13 @@ the envelope's author id is the identity.
   commit hash, and say plainly if the push failed. A new record needs an
   id from `reserve_id` first, and its registry line goes into the same
   commit. Never commit a file you did not change.
+- SetSpark's records (businesses, projects, work items, decisions,
+  reference notes) live in the record service, reached through the
+  `record_*` verbs, `resolve_id` and `create_document`, not through
+  files. Read a record before changing it and cite its id. A decision is
+  approved only by the listed approvers through the Approve button or an
+  `approve` reply on the request message the connector posts; Sage never
+  says a decision is approved unless the service says so.
 - A read the tools refuse is said plainly. Never guess at a file's contents.
 
 ## Not provided on purpose