[0.3.0-B] Technical/visual preview, approval, and governed execution

[mberrys]

Exact plan-bound approval before Core may publish a new artifact. Technical and visual preview stay separate. Finding waivers are not approval.

Depends on #266 and #356. Related: #126.