Refactor app/packages/access/request onto the ApprovalWorkflowService capability (policy + effect strategies)

[gcharest]

Note

This issue mirrors task-61 in this repository's Backlog.md backlog, which is the source of truth for planned work.
Comments are welcome and read by maintainers; the issue body is overwritten on every sync.

Description

Aligns with decisions/approvals.md and decisions/events.md. Refactor app/packages/access/request to consume the generic ApprovalWorkflowService (TASK for infrastructure/approvals extraction) by supplying access-specific ApprovalPolicy and EffectHandler strategies, and retire the two mis-routed mechanisms it currently relies on.

Desired end state:

1. access/request holds only access-specific policy + effect strategies (approver resolution, thresholds, the grant/revoke effect); all generic workflow machinery comes from infrastructure/approvals.
2. The access/sync completion hand-off (SYNC_COMPLETED / SYNC_FAILED) that today advances the request via the in-process event bus is reclassified as a workflow step and delivered over the outbox / QueueService (TASK-34) — a durable step, not an event.
3. The operator-alert notification ('no approvers found') is rehomed onto the notifications capability (TASK-32), not the event bus.
4. Behavior is preserved end to end (submit -> approve -> grant, rejection, expiry, sync-driven advance).

Depends on the approvals capability extraction, the QueueService/outbox (TASK-34), and the notifications capability (TASK-32). The task-planner agent must assess feasibility as one PR vs decomposition into incremental subtasks that keep the live access flow green throughout.

Acceptance Criteria

• access/request supplies only access-specific ApprovalPolicy + EffectHandler; all generic workflow machinery comes from infrastructure/approvals
• SYNC_COMPLETED/SYNC_FAILED advance is reclassified as a durable workflow step delivered over the outbox/QueueService, not the event bus
• The 'no approvers found' operator alert is rehomed onto the notifications capability, not the event bus
• Submit -> approve -> grant, rejection, expiry, and sync-driven advance all behave as before (tests green)

Definition of Done

• No access-request logic flows through the in-process event dispatcher
• PR references decisions/approvals.md

Dependencies

• Extract the generic human-approval workflow capability into app/infrastructure/approvals/ #1368 (task-60)
• QueueService Protocol and outbox relay (build when a durable cross-process reaction exists) #1288 (task-34)
• Resolve the empty infrastructure services: persistence/ and notifications/ #1286 (task-32)

References

• decisions/approvals.md
• decisions/events.md