Persist step approvals and guard squad HTTP entry points

Why: A step confirmation cancelled the whole run, approvals and repair budget vanished on restart, and the HTTP server accepted anonymous and oversized requests.
Evidence: GOWORK=off go vet ./... && GOWORK=off go test -count=1 ./... && GOWORK=off go test -race ./squad/... passed. scripts/submodule-consistency.sh ok.
Impact: Approve and skip apply to one step; runstate.json and unix flock survive restart; wakeup leaves permission holds pending; serve defaults to loopback and requires a token off-loopback.
Refs: Q1 Q2 Q3 Q4 Q5 Q8 Q9 Q14 Q15 Q16
Co-authored-by: Cursor <cursoragent@cursor.com>

store/store.go

@@ -56,12 +56,12 @@ func (s *FileStore) LoadRoles(reg *squad.RoleRegistry) error {
 }
 
 // SaveRole 落盘单个角色。
-func (s *FileStore) SaveRole(spec squad.RoleSpec) {
+func (s *FileStore) SaveRole(spec squad.RoleSpec) error {
 	data, err := json.MarshalIndent(spec, "", "  ")
 	if err != nil {
-		return
+		return err
 	}
-	_ = os.WriteFile(filepath.Join(s.DataDir, "roles.d", spec.Role+".json"), data, 0o644)
+	return squad.AtomicWrite(filepath.Join(s.DataDir, "roles.d", spec.Role+".json"), append(data, '\n'))
 }
 
 // DeleteRole 删除角色文件（注册表删除由调用方完成）。
@@ -96,12 +96,12 @@ func (s *FileStore) LoadBlueprints(bps *squad.BlueprintRegistry) error {
 }
 
 // SaveBlueprint 落盘单个蓝图。
-func (s *FileStore) SaveBlueprint(bp squad.Blueprint) {
+func (s *FileStore) SaveBlueprint(bp squad.Blueprint) error {
 	data, err := json.MarshalIndent(bp, "", "  ")
 	if err != nil {
-		return
+		return err
 	}
-	_ = os.WriteFile(filepath.Join(s.DataDir, "blueprints.d", bp.Key+".json"), data, 0o644)
+	return squad.AtomicWrite(filepath.Join(s.DataDir, "blueprints.d", bp.Key+".json"), append(data, '\n'))
 }
 
 // DeleteBlueprint 删除蓝图文件。