fix: make approveStage idempotent to prevent duplicate Analysis stage

When an ApprovalPolicy auto-approves the Analysis stage, calling
approveStage('Analysis') again would fail with a duplicate error.
Move the guard into the hook itself so all callers are protected.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: jrangelramos

src/components/update-plan/DecisionActions.tsx

@@ -44,8 +44,7 @@ const DecisionActions: React.FC<DecisionActionsProps> = ({ proposal, clusterVers
     [approvals, proposal.metadata?.name, proposal.metadata?.namespace],
   );
 
-  const { approveStage, denyStage, error, clearError, inProgress } =
-    useApprovalActions(approval);
+  const { approveStage, denyStage, error, clearError, inProgress } = useApprovalActions(approval);
 
   const [confirmingApprove, setConfirmingApprove] = React.useState(false);
   const [confirmingDeny, setConfirmingDeny] = React.useState(false);
@@ -109,7 +108,15 @@ const DecisionActions: React.FC<DecisionActionsProps> = ({ proposal, clusterVers
         setConfirmingApprove(false);
       }, CONFIRM_TIMEOUT_MS);
     }
-  }, [confirmingApprove, approveStage, proposal, clusterVersion, history, t]);
+  }, [
+    confirmingApprove,
+    approveStage,
+    approval?.spec?.stages,
+    proposal,
+    clusterVersion,
+    history,
+    t,
+  ]);
 
   const handleDenyClick = React.useCallback(async () => {
     if (confirmingDeny) {

src/hooks/useApprovalActions.ts

@@ -23,6 +23,8 @@ export const useApprovalActions = (approval?: LightspeedProposalApproval) => {
       setError(null);
       try {
         const existingStages = currentApproval.spec?.stages ?? [];
+        if (existingStages.some((s) => s.type === stageType)) return true; // already approved
+
         const stageEntry: Record<string, unknown> = {
           type: stageType,
           decision: 'Approved',