fix: sealed peer sync smoke + clearer approval denials (0.9.18)

CLI/Docker assert AEAD sync; status shows sealed channel; headless denials no longer pretend the user refused.

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/test_parliament.c

@@ -73,6 +73,7 @@ int main(void) {
   char *st = cst_parliament_status_text();
   assert(st && strstr(st, "parliament"));
   assert(strstr(st, "service"));
+  assert(strstr(st, "peer_sync") && strstr(st, "sealed"));
   free(st);
   assert(cst_parliament_is_active());
   assert(cst_parliament_daemon_info(NULL, NULL, 0, NULL) != 0);