feat: HITL — continuation-based human-in-the-loop

- dispatcher-check: add :level :approval-required to network/high-impact returns
- cognitive-verify: distinguish approval-required from hard rejection; pass
  approval requests through to act gate instead of returning early
- loop-gate-reason: don't retry approval requests; pass them as approved-action
  with :status :requires-approval
- loop-gate-act: detect approval-required, create Flight Plan, dispatch HITL
  message to user's client, don't execute original action
- loop-gate-perceive: handle re-injected approved signals from
  dispatcher-approvals-process; set :approved-action on signal
- dispatcher-approvals-process: fix function name (stimulus-inject) and wrap
  action in proper signal envelope with :sensor :approval-required
- Fix: list-objects-with-attribute → memory-objects-by-attribute
- Fix: org-id-new → org-id-generate
- Fix: inject-stimulus → stimulus-inject (correct function name)

Flow:
1. LLM proposes high-risk action → dispatcher returns approval-required
2. cognitive-verify collects approval request → passes to reason as :requires-approval
3. loop-gate-act creates Flight Plan → dispatches HITL message to client → exits
4. Human approves in Emacs → heartbeat re-injects with :approved t
5. Re-injected signal flows through pipeline → dispatcher passes through
6. Action executed normally

org/core-loop.org

@@ -95,15 +95,15 @@ The function handles four failure modes:
           (return nil))
 
         (handler-case
-            (progn
-              (setf current-signal (perceive-gate current-signal))
-              (setf current-signal (reason-gate current-signal))
-              (let ((feedback (act-gate current-signal)))
-                (if feedback
-                    (progn
-                      (unless (getf feedback :meta) (setf (getf feedback :meta) meta))
-                      (setf current-signal feedback))
-                    (setf current-signal nil))))
+             (progn
+               (setf current-signal (perceive-gate current-signal))
+               (setf current-signal (reason-gate current-signal))
+               (let ((feedback (act-gate current-signal)))
+                 (if feedback
+                     (progn
+                       (unless (getf feedback :meta) (setf (getf feedback :meta) meta))
+                       (setf current-signal feedback))
+                     (setf current-signal nil))))
           (error (c)
             (let ((sensor (ignore-errors (getf (getf current-signal :payload) :sensor))))
               (log-message "METABOLISM CRASH [~a]: ~a" (or sensor :unknown) c)