auto-approve sparse checkout

Trap: sparse-checking out only auto-approve-repos.txt looks sufficient because it is the workflow’s policy input, but auto-approve.yml also runs src/publish/record-auto-approval-attestation.js; the absent script fails with MODULE_NOT_FOUND. Fix: include the entry point and its local dependencies in sparse checkout, and test checkout contents—not only textual step ordering.