perf(executor): recover approved steps on engine restart

When the engine restarts mid-step, an in-progress step may have already
passed plan + code review but not yet been flipped to done by the agent's
next task_update call. Previously, the next executor pass re-entered the
step and replayed both reviews — measured at 5-20 min of pure waste per
restart (observed in FN-2215 Step 1 and FN-2207 Step 6).

recoverApprovedStepsOnResume scans the task log for any in-progress step
whose most recent "code review Step N: APPROVE" entry is newer than its
most recent "Step N → pending" transition, and marks those steps done
before execute() runs. Safely skips steps that were reset after approval
(e.g. by a workflow revision) or only received REVISE verdicts.

Called from both the engine-restart path (resumeOrphaned) and the
unpause path, matching the two places the task log shows as vulnerable
to this race.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/cli/src/__tests__/build-exe-cross.test.ts

@@ -127,14 +127,15 @@ describe("build-exe-cross: --all builds all platforms", () => {
 
     const result = spawnSync(bin, ["--help"], {
       encoding: "utf-8",
-      timeout: 15_000,
+      // CI can occasionally be slow to launch freshly built native binaries.
+      timeout: 45_000,
     });
     if (hasKnownBunSqliteLimitation(result)) {
       return;
     }
     expect(result.status).toBe(0);
     expect(result.stdout).toContain("fn");
-  }, 20_000);
+  }, 60_000);
 });
 
 describe("build-exe-cross: default (no args) backward compatibility", () => {