feat(cli): vouch approve accepts multiple ids for scriptable bulk approval

[dripsmvcp]

Summary

• vouch approve <id1> <id2> … now approves multiple proposals in one non-interactive call, for CI and clearing a review backlog (feat: vouch approve --batch for scriptable bulk approval #93). Complements the interactive vouch review queue.

Root Cause / Context

Enhancement, not a bug. vouch approve accepted a single proposal_id only (src/vouch/cli.py), so bulk approval meant one process per proposal. The issue asks for a scriptable batch with one audit event per artifact and clear all-or-nothing vs best-effort semantics.

Fix

• CLI approve takes variadic proposal_ids (nargs=-1) plus --keep-going. Single-id usage is unchanged.
• Default = all-or-nothing: every id is validated via the new proposals.check_approvable() before any write, so a typo or already-decided id aborts the batch and approves nothing.
• --keep-going = best-effort: approve each id independently, print ✗ <id>: <reason> for failures, exit non-zero if any failed.
• proposals.check_approvable() / _approval_block_reason() extract the not-pending + forbidden-self-approval gates into one read-only helper; approve() now reuses it, so the single-approve path and the batch precheck can't drift. Error messages are byte-for-byte unchanged.
• One audit event per approved artifact (unchanged — do_approve logs per call).

Test Plan

• Feature tests added in tests/test_cli.py: test_approve_batch_approves_all, test_approve_batch_one_audit_event_per_artifact, test_approve_batch_atomic_aborts_on_bad_id, test_approve_batch_keep_going_best_effort
• 3 of the 4 fail on the parent commit (single-arg approve rejects extra args); all pass with the fix
• ruff + mypy clean; full suite green except one pre-existing failure (test_crystallize_cli_partial_failures_shows_warning) that also fails on clean upstream/test (environment-sensitive _whoami())

$ python -m pytest tests/test_cli.py -q -k approve_batch
....                                                   [100%]
$ python -m ruff check src tests
All checks passed!
$ python -m mypy src
Success: no issues found in 31 source files

Closes #93

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a4da897e-7c42-40c0-b1ae-6fb921f4fc31

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}