Work Orders — end-to-end lifecycle

Every Approve in the control plane mints a work order automatically; records update live at each stage and terminal states are kept immutable for audit and traceability.