Add a requirements-only approval policy matcher so managed requirements can allow any granular approval-policy shape with { granular = "any" }. This keeps runtime AskForApproval concrete while avoiding enumerating every granular flag permutation.
Co-authored-by: Codex <noreply@openai.com>