lane-policy: let an approved candidate exception push from the owning lane #196

Problem

The lane-policy guard refuses git push from a worker lane even when the coordinator has approved a documented candidate exception (PI_CANDIDATE_EXCEPTION=urgent-fix) for that exact branch. The lane is told to "deliver to R-: orch deliver ...", but the repository has no repo orchestrator for this item, and the exception route says the item gets its own PR. The coordinator then has to push and open the PR by hand on the lane's behalf.

Expected

An approved urgent-fix or major exception for a named branch lets the lane that owns that branch push and open its PR. The approval would be recorded by the coordinator, for example as a short-lived grant scoped to the lane, repo and branch. Otherwise the guard should name the exact approval route instead of only pointing at the orchestrator delivery.

Why

Guards in orchestrated lanes should not block approved work. Right now every approved security patch has to round-trip through the coordinator's own session.