Bind live approval request and ticket digests

[uesugitorachiyo]

Summary

• add request_sha256 and ticket_sha256 to live-mutation approval readbacks
• assert the accepted Command-to-Covenant ticket fixture preserves exact request and ticket byte digests

Verification

• go test ./internal/cli -run 'TestLiveMutationApprovalReportsApprovedTicketReadOnly|TestLiveMutationApprovalBlocksPendingTicketReadOnly' -count=1
• go test ./... -count=1
• go vet ./...
• go build -o target/ao-command-p0b-node-03 ./cmd/ao-command
• scripts/ao-command-smoke.sh --forge /Users/torachiyouesugi/Documents/public/ao-forge --foundry /Users/torachiyouesugi/Documents/public/ao-foundry --out tmp/ao-command-smoke
• scripts/public-readiness-audit.sh --forge /Users/torachiyouesugi/Documents/public/ao-forge --out tmp/public-readiness-audit.json
• scripts/production-readiness-audit.sh --forge /Users/torachiyouesugi/Documents/public/ao-forge --foundry /Users/torachiyouesugi/Documents/public/ao-foundry --covenant /Users/torachiyouesugi/Documents/public/ao-covenant --architecture /Users/torachiyouesugi/Documents/public/ao-architecture --out tmp/production-readiness-audit.json --skip-remote-admin
• git diff --check
• scoped public-safety wording scan over changed files