feat: add approval, activation, and rollback flow for agentic config tuning

Summary

Add the approval and activation workflow for offline agentic config tuning after proposals are generated and evaluated.

Parent roadmap: #2287 Parent issue: #2340 Depends on: #2326, #2333, agentic proposal contract issue Related code: dashboard/backend/handlers/config.go, dashboard/backend/evaluation, src/semantic-router/pkg/config, src/vllm-sr/cli, deploy/operator

Motivation

Agentic config tuning is only production-safe if candidate changes go through validate, diff, eval, approval, activation, and rollback. This issue defines the control-plane path that turns an accepted proposal into a versioned config snapshot.

Scope

Implement or design:

• approval states and reviewer/CI gates;
• activation through versioned snapshot APIs;
• rollback and audit trail;
• dashboard/CLI/operator integration points;
• failure behavior when evals regress or approval expires.

Non-goals

• Do not allow automatic online activation without explicit policy.
• Do not bypass config validation or diff review.
• Do not couple approval workflow to a single LLM provider.

Acceptance criteria

• A candidate tuning proposal cannot activate without passing configured gates.
• Activation produces a versioned config snapshot with rollback metadata.
• Dashboard/CLI can display proposal status and evaluation evidence.