fix(approvals): surface decision attachments through the listActions contract mapping (#3266)

Browser verification caught a #3268 gap: the `attachments` column landed on
sys_approval_action and decide() persisted it, but rowFromAction never mapped
it — every listActions consumer (REST /actions, the console timeline) saw
none while the raw engine row carried the fileIds. Map it (and type it on the
ApprovalActionRow contract) so the audit trail actually exposes what was
attached. Regression test added: 137 green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016ypkQikZ55oWUHUnMebwXA

Author: claude

packages/plugins/plugin-approvals/src/approval-service.test.ts

@@ -1446,3 +1446,18 @@ describe('ApprovalService — decision_progress & deep links (#2678 P1.5)', () =
     expect(note.payload.actionUrl).toBe(`/system/approvals?request=${encodeURIComponent(req.id)}`);
   });
 });
+
+// listActions must surface decision attachments through the contract mapping
+// (#3266 — the column existed but rowFromAction dropped it; caught in browser).
+describe('ApprovalService — listActions attachments mapping (#3266)', () => {
+  it('returns the attachments recorded on a decision', async () => {
+    const engine = makeFakeEngine();
+    let n = 0;
+    const svc = new ApprovalService({ engine: engine as any, clock: { now: () => new Date(1757000000000 + (n++) * 1000) } });
+    const req = await svc.openNodeRequest(openInput(['u9']), CTX);
+    await svc.decideNode(req.id, { decision: 'approve', actorId: 'u9', attachments: ['file_a'] }, SYS);
+    const acts = await svc.listActions(req.id, SYS);
+    const approve = acts.find(a => a.action === 'approve');
+    expect(approve?.attachments).toEqual(['file_a']);
+  });
+});

packages/plugins/plugin-approvals/src/approval-service.ts

@@ -205,6 +205,10 @@ function rowFromAction(row: any): ApprovalActionRow {
     action: row.action,
     actor_id: row.actor_id ?? undefined,
     comment: row.comment ?? undefined,
+    // Decision attachments (#3266). The column shipped in #3268 but this
+    // contract mapping didn't — the raw engine row carried the fileIds while
+    // every consumer of listActions saw none (caught by browser verification).
+    attachments: Array.isArray(row.attachments) && row.attachments.length ? row.attachments.map(String) : undefined,
     created_at: row.created_at ?? undefined,
   };
 }

packages/spec/src/contracts/approval-service.ts

@@ -145,6 +145,8 @@ export interface ApprovalActionRow {
   action: ApprovalActionKind;
   actor_id?: string;
   comment?: string;
+  /** File references attached to this action (decision attachments, #3266). */
+  attachments?: string[];
   created_at?: string;
   /** Display name of the actor (`sys_user.name`), when resolvable. */
   actor_name?: string;