#46 FTX-46: apply_action rewrite with row locking

Single transaction: lock decision FOR UPDATE then task FOR UPDATE (global lock order); guard non-terminal+actionable; assignee/SoD checks; quorum re-evaluated from persisted tasks LEFT JOIN actions; terminalize() as sole terminal-state setter with dedup_key'd terminal webhook enqueue. Race tests: concurrent double-approve -> one 200 one 409; partial unique on completing actions. Phase 2.