Block approve_ceo_strategy until hires exist

The CEO prompt carried a plea — "do not submit strategy before hires,
we have observed a loop" — in place of an actual gate. The model
could (and did) ignore it, land back in team_building mode, and
resubmit. Move the invariant into the /approvals POST handler:
reject approve_ceo_strategy with 409 STRATEGY_BEFORE_HIRES when no
hire_agent approval exists for the company, and 409 STRATEGY_ALREADY_FILED
when one is already pending or approved.

Introduce listCompanyApprovalsByType on the database facade to keep
the route stateless. Trim the prompt to describe the gate instead of
begging the model to obey.

src/main/database/approvals.ts

@@ -349,6 +349,19 @@ export function buildApprovalMethods(
       return row ?? null;
     },
 
+    /**
+     * Returns every approval in the company whose `type` matches exactly.
+     * Used by the approvals POST route to enforce ordering invariants
+     * (e.g. "approve_ceo_strategy must trail hire_agent").
+     */
+    listCompanyApprovalsByType(companyId: string, type: string): Array<{ id: string; state: string }> {
+      return readAll<{ id: string; state: string }>(
+        `SELECT id, state FROM approvals WHERE company_id = ? AND type = ? ORDER BY created_at ASC`,
+        companyId,
+        type,
+      );
+    },
+
     /**
      * Returns true when the given agent has a pending review-type approval
      * against one of their tasks. Used by checkpoint-engine to decide