Harden Puber workflow user-action gates

[rovkinmax]

Summary

• add approval re-check guard to Puber needs_user_action prompts
• gate ship_pr -> no_pr cleanup paths behind user approval
• clean stale approval-required wording from automatic fix transitions
• update project contract, workflow docs, ship-pr contract, and workflow snapshots

Verification

• kent workflow validate --mode execution for all 9 Puber workflows
• live DB invariant query: no missing needs_user_action guard, no unapproved no_pr cleanup, no early done, no terminal blocked, no stale approval descriptions
• jq empty .kent/workflows/puber-*.json
• git diff --check
• compliance_reviewer follow-up: No blocking findings