feat(agentic): add @agentic-kit/run-log-gate — tool approvals over the run log

[pyramation]

Summary

Extracts functions-lib/run-log-gate from constructive-db (landed there as @constructive-fn/run-log-gate in constructive-io/constructive-db#3752) into this repo as @agentic-kit/run-log-gate, next to run-log and harness which are its only dependencies. Nothing in it is constructive-db-specific; constructive-db will switch to the published package and delete its copy as a follow-up.

Three pieces, all keyed by toolCallId so retries are idempotent against the store:

runLogApprovals({ store, runId, ... }): ApprovalChannel   // request entry `approval-<toolCallId>`, polls for the resolution
resolveApproval(store, runId, { toolCallId, decision, reason? })  // resolution entry `resolution-<toolCallId>`
runLogGateDecisions({ store, runId }): { onDecision, flush }  // audit entry `gate-<toolCallId>`; flush() rethrows the first lost write
createRunLogGateHost({ store, runId, onRequested?, onDecided? }): GateHost & { drain(): Promise<void> }

The gate host takes only a RunLogStore + runId — scope/entity/actor/visibility stay on the parent run, the package never names a scope.

Sources, tests (19) and README moved verbatim apart from the package name; package.json follows agentic/run-log (workspace:^ peers, SEE LICENSE IN LICENSE, dist publishing).

Link to Devin session: https://app.devin.ai/sessions/0cc6fbd1bf5946b9957c6e97f097354a
Open in Devin Desktop: https://app.devin.ai/desktop/session/0cc6fbd1bf5946b9957c6e97f097354a?variant=devin
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[tenki-reviewer]

Review complete. No issues found — approved ✅.

---

This PR introduces the agentic/run-log-gate package (approvals, gate-decisions, gate-host) plus its test suite, tsconfig, jest config, and README. It builds an approval workflow that polls the run-log event store for pending tool requests, applies configured timeout/decision rules, and appends resolutions.

Files	Change
src/approvals.ts, src/gate-decisions.ts, src/gate-host.ts, src/index.ts	Implements the log-polling approval channel, decision mapping, and host wiring
__tests__/approvals.test.ts, gate-decisions.test.ts, gate-host.test.ts	Adds coverage for polling, decisions, and host behavior
jest.config.js, package.json, tsconfig*.json, README.md	Package scaffolding and docs

_{Reviewed commit: 7f9cf5e}