System pipelines

Maintenance processes the system runs on itself (plan → approval → execution in the worker). Supervised by default: a planned run waits for your approval; auto-approve is the per-pipeline trust dial.