test(events): reject replay apply without approval ref

ReplayPlan two-person apply already required digest match; this pins the missing ApprovalRef negative so dry-run tickets cannot skip the ticket field.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/events/replay_test.go

@@ -27,6 +27,10 @@ func TestApplyReplayRequiresMatchingDigestAndTwoPerson(t *testing.T) {
 	if err := ApplyReplay(p, "deadbeef"); err == nil {
 		t.Fatal("digest mismatch must fail")
 	}
+	p.ApprovalRef = ""
+	if err := ApplyReplay(p, digest); err == nil {
+		t.Fatal("apply without approval ref must fail")
+	}
 }
 
 func TestLegacyAuthorizeReplayStillDryRunOnly(t *testing.T) {