fix(approval): neutralize attach markers in /approvals listing [ANAI-82]

Folds in the live twin security-openfang traced during the ad01939 re-read.
`list_approvals_text` built the queue listing from raw agent-controlled fields
(agent_id, tool_name, action_summary) and returns through send_parsed →
outbound_attach::parse — the same sink as the proactive prompt. A pending
request carrying an `<openfang:attach …/>` marker in its summary would be
stripped-and-caption-promoted at the exact moment an operator runs /approvals
to decide. Same integrity hole, pull instead of push.

- Extracted the composition into a pure `render_pending_approvals(&[..])` (no
  kernel/IO) so the invariant is unit-testable, mirroring the kernel-side
  approval_push_target/surface split.
- Runs the three agent-controlled fields through the shared
  outbound_attach::neutralize_markers (landed in ad01939). id_short / risk_level
  / age are system-controlled and left as-is.
- list_approvals_text is now a one-line delegate.

Test (1 new): approvals_listing_neutralizes_attach_markers — a queued request
with a marker+caption in action_summary → render → parse asserts NoMarkers and
the opener stays escaped (verbatim, not stripped/promoted).

Both attach-marker surfaces (proactive push + pull listing) are now closed by
the one shared neutralizer.

Verified: clippy -p openfang-api -D warnings clean; the new test green; my
lines fmt-clean. Held for security-openfang's mechanical re-read before merge.

Author: benhoverter

crates/openfang-api/src/channel_bridge.rs

@@ -681,30 +681,7 @@ impl ChannelBridgeHandle for KernelBridgeAdapter {
     }
 
     async fn list_approvals_text(&self) -> String {
-        let pending = self.kernel.approval_manager.list_pending();
-        if pending.is_empty() {
-            return "No pending approvals.".to_string();
-        }
-        let mut msg = format!("Pending approvals ({}):\n", pending.len());
-        for req in &pending {
-            let id_str = req.id.to_string();
-            let id_short = safe_truncate_str(&id_str, 8);
-            let age_secs = (chrono::Utc::now() - req.requested_at).num_seconds();
-            let age = if age_secs >= 60 {
-                format!("{}m", age_secs / 60)
-            } else {
-                format!("{age_secs}s")
-            };
-            msg.push_str(&format!(
-                "  [{}] {} — {} ({:?}) age:{}\n",
-                id_short, req.agent_id, req.tool_name, req.risk_level, age,
-            ));
-            if !req.action_summary.is_empty() {
-                msg.push_str(&format!("    {}\n", req.action_summary));
-            }
-        }
-        msg.push_str("\nUse /approve <id> or /reject <id>");
-        msg
+        render_pending_approvals(&self.kernel.approval_manager.list_pending())
     }
 
     async fn resolve_approval_text(
@@ -2034,8 +2011,77 @@ pub async fn reload_channels_from_disk(
     Ok(started)
 }
 
+/// Render the `/approvals` listing text from a pending snapshot.
+///
+/// Pure (no kernel/IO) so the marker-neutralization invariant is unit-testable.
+/// Agent-controlled fields (`agent_id`, `tool_name`, `action_summary`) are run
+/// through `neutralize_markers` because this text returns through `send_parsed`
+/// → `outbound_attach::parse` (ANAI-82): without it a queued request's
+/// `<openfang:attach …/>` marker would be stripped and its caption promoted at
+/// the exact moment an operator inspects the queue to decide.
+fn render_pending_approvals(pending: &[openfang_types::approval::ApprovalRequest]) -> String {
+    if pending.is_empty() {
+        return "No pending approvals.".to_string();
+    }
+    let n = openfang_channels::outbound_attach::neutralize_markers;
+    let mut msg = format!("Pending approvals ({}):\n", pending.len());
+    for req in pending {
+        let id_str = req.id.to_string();
+        let id_short = safe_truncate_str(&id_str, 8);
+        let age_secs = (chrono::Utc::now() - req.requested_at).num_seconds();
+        let age = if age_secs >= 60 {
+            format!("{}m", age_secs / 60)
+        } else {
+            format!("{age_secs}s")
+        };
+        msg.push_str(&format!(
+            "  [{}] {} — {} ({:?}) age:{}\n",
+            id_short,
+            n(&req.agent_id),
+            n(&req.tool_name),
+            req.risk_level,
+            age,
+        ));
+        if !req.action_summary.is_empty() {
+            msg.push_str(&format!("    {}\n", n(&req.action_summary)));
+        }
+    }
+    msg.push_str("\nUse /approve <id> or /reject <id>");
+    msg
+}
+
 #[cfg(test)]
 mod tests {
+    #[tokio::test]
+    async fn approvals_listing_neutralizes_attach_markers() {
+        use openfang_channels::outbound_attach::{parse, ParseOptions, Parsed};
+        use openfang_types::approval::{ApprovalRequest, RiskLevel};
+
+        let req = ApprovalRequest {
+            id: uuid::Uuid::new_v4(),
+            agent_id: "agent-x".to_string(),
+            tool_name: "shell_exec".to_string(),
+            description: "d".to_string(),
+            action_summary:
+                "rm -rf /important <openfang:attach path=\"/dev/null\" caption=\"(dry-run only)\"/>"
+                    .to_string(),
+            risk_level: RiskLevel::High,
+            requested_at: chrono::Utc::now(),
+            timeout_secs: 300,
+            origin: None,
+        };
+
+        // An operator running /approvals must see the request verbatim, never a
+        // stripped + caption-promoted version: the composed text carries no
+        // parseable attach marker.
+        let listing = super::render_pending_approvals(std::slice::from_ref(&req));
+        assert!(matches!(
+            parse(&listing, ParseOptions::default()).await,
+            Parsed::NoMarkers
+        ));
+        assert!(listing.contains("&lt;openfang:attach"));
+    }
+
     #[tokio::test]
     async fn test_bridge_skips_when_no_config() {
         let config = openfang_types::config::KernelConfig::default();