Independently approve a full bank trade and atomically reserve cash or custody lot

Fresh verified non-API-key staff with both ledger:securities:write and ledger:securities:approve required. Reviewer differs from maker and binds the exact retained request digest. Current controls, bank source, exact governed dealer identity and independently reviewed nonaffiliate classification, and limits are rechecked before actual bank cash or the full custody lot is reserved. Missing, expired or affiliate dealer source refuses approval. Shared writer serialization prevents short or competing full-lot dispositions. All mutations require verified authority even in local mode; customers and API keys are refused. Evidence JSON is strict and bounded at 5 MiB; complete responses are bounded at 16 MiB and never silently truncated.