fix: eight validated bug-hunt fixes across approvers, serve, resource

[jkyberneees]

• Telegram approval: duplicate callback no longer deadlocks the update loop; pending approval registered before SendMessage
• Approvers (WS + Telegram): trustAll honors TrustShortcutAllowed — destructive/blocked/unknown always prompt
• WS approver: trust grants count toward approval friction
• serve: token/error frames no longer mutate terminal runs; explicit events limit=0 returns the full ring (documented + tested)
• resource: escape backslashes in glob queries
• fsatomic: surface directory-open failure instead of skipping the rename-durability fsync

Adversarially reviewed (3 reviewers, clean). Scoped suites green with -race.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	odek	2113061	Commit Preview URL Branch Preview URL	Sep 27 2026, 04:39 PM