#71 FTX-71: Clearance profiles (P2)

clearance_instances table + clearance tasks as ordinary tasks rows (tasks.clearance_instance_id) through same engine (UB-CLR-1); decisions.clearance_state cache; policy clearance{profile{key,steps},trigger{always|risk_threshold|reviewer_request}}; request_clearance action (EV-ACT-5); terminalize clearance gate -> approved_pending_clearance + ONLY decision.clearance_required webhook (UN-CLR-1); clearance approve -> approved (EV-CLR-2), reject -> rejected (EV-CLR-3); expiry during clearance -> timed_out. Phase 7 (lands after Phase 2).