fix(bundle): drop the approval service from the Windows layer entirely

The Windows layer previously kept the approval service with policy 'never',
which made the approval plugin inject 'Approval prompts are disabled in
this session: actions that require approval are rejected automatically'
into the model context. On Windows nothing asks for approval — the
escalation surfaces (sandbox_permissions) do not exist — so the sentence
described a rejection surface that is not there. The layer now disables
the approval row too: the service is absent, the model is never told
approval exists, and the danger-full-access degradation is complete.

base.spec.ts pins approval among the Windows disables; the Agent Note and
bundle README record the absent service.

packages/bundle/base/windows.cordis.patch.yml

@@ -1,12 +1,14 @@
 # The dsh-base Windows platform layer: applied by the dsh launcher on win32
 # hosts, between the bundle layers and the user layers. Windows cannot run
 # the POSIX-only sandboxed stacks, so this layer swaps the shipped bash stack
-# for the PowerShell stack AND drops the sandbox entirely: no OS runner
-# exists on Windows (landlock/bwrap/seatbelt are POSIX-only), so any policy
-# would be theater — the unconfined shell could bypass fs-only path rules
-# with one command. Windows therefore degrades to danger-full-access:
+# for the PowerShell stack AND drops the whole permission surface: no OS
+# runner exists on Windows (landlock/bwrap/seatbelt are POSIX-only), so any
+# policy would be theater — the unconfined shell could bypass fs-only path
+# rules with one command. Windows therefore degrades to danger-full-access:
 # unconfined pwsh + unconfined fs (`dsh-fs-local`), no permission switcher
-# (dsh-permission requires a confining executor), approval policy `never`.
+# (dsh-permission requires a confining executor), and no approval service —
+# nothing in the roster asks for approval, and the model is never told
+# approval exists or that requests are auto-rejected.
 # The launcher reads THIS file from the base bundle package (never through
 # dsh.bundle.patch — that field names the one universal layer). A Windows
 # host that prefers bash or confinement overrides these rows through its
@@ -34,8 +36,7 @@
   disabled: true
 
 - id: approval
-  config:
-    policy: never
+  disabled: true
 
 - insert:
     - id: pwsh-local