fix: prevent denied jobs from bypassing policy via retry

[pilipilisbot]

Problem

The dashboard/API retry path requeued denied and waiting_approval jobs directly to pending, bypassing the policy decision recorded when the job was created. A denied workflow_run could therefore be dispatched by an admin retry.

Fix

• At the queue transition, only permit retry of blocked jobs whose recorded decision is executable (auto_trusted). This guards both API and CLI callers atomically.
• Hide Retry for policy-denied/approval-pending jobs in the dashboard while retaining Dismiss.
• Update operations documentation and add queue/API/UI regression coverage.

Verification

• pytest -q (full suite)
• npm --prefix dashboard test -- --run
• npm --prefix dashboard run build

This does not re-evaluate a blocked job against a policy changed after initial enqueue; that is a separate follow-up guardrail.

[giscebot]

Approved. I checked the retry transition end to end: the queue now enforces blocked plus auto_trusted atomically, so both API and CLI callers reject denied and approval-pending jobs; the dashboard keeps Dismiss available while hiding Retry; operations documentation matches the behavior. The branch contains current main and remains MERGEABLE/CLEAN. Local verification on the reviewed commit: pytest 436 passed, dashboard 64 passed, production build succeeded and reproduced the committed static bundle, and git diff --check passed.