feat: export gates generated work on approval, and signs it itself

[khaneight]

Stacked on #72. Safeguards 3 and 4 from the design, enforced where publishing actually happens.

$ sentinel export --out ./content --flat
Exported: 2 article(s) → ./content

  ! 1 article(s) written by the clone are finished but unsigned.
    sentinel review           # see them
    sentinel review <slug> --approve

The gate

An origin: extrapolated article publishes only when its latest verdict is
approved. Approval is a different axis from maturity — stable means
finished, approved means the archive's owner signed it — so neither
--status nor --include-drafts opens it. Tested: a flag that could override
this would make the gate advisory rather than structural.

Held-back articles are counted separately (held_for_approval) and said
plainly. It is the one exclusion the owner can clear with a single command, and
folding it into a list headed "not publishable" reads as work that is not ready.

The notice

---

*Written by a language model working from this archive, extending its author's
own writing rather than reproducing it. Written from: Builds an argument from a
concrete case before generalising. Approved by khaneight on 2026-08-26.*

Written by the exporter, not by the agent that wrote the article — an agent
that composes its own disclosure is an agent that can leave it out. It names the
claims the piece was written from, in the words the trait records, so a reader
who disagrees can disagree with the premise rather than only the conclusion.
Ordinary compiled articles get no notice: attaching it to everything would make
it furniture.

The bundle

What a front end needs to show a system rather than a website:

• extrapolated on every node — a UI that renders the clone's work like the
  author's own misleads its readers
• persona — affirmed traits only. A proposed trait is an unconfirmed
  reading, and publishing one puts a claim about a person in front of readers
  before the person has seen it. Each carries evidence_count, never the raw/
  paths: citing documents nobody can open is citing sources at readers who
  cannot check them. expressed_in links a claim to what was written from it.
• in_progress — unpublished, awaiting approval, unconfirmed traits, wanted

Two defects found by reading the output

I exported a real archive and opened the file. cargo fmt had wrapped the
notice string into the middle of a sentence (archive — extending),
and joining claims that already end in a full stop produced generalising...
Both fixed, with a test that asserts the notice reads as a sentence rather than
that it merely contains the right substrings.

506 tests (+6), clippy and fmt clean.

🤖 Generated with Claude Code