pending approval. The API replays the frozen action through the
same service that would have run it live, then records the result and sets
status to executed (or failed with an error). Only pending approvals can
be approved.
Cross-user variant: POST /v1/approvals/:id/approve.