fix: sealed peer sync smoke + clearer approval denials (0.9.18)

CLI/Docker assert AEAD sync; status shows sealed channel; headless denials no longer pretend the user refused.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/parliament.c

@@ -468,5 +468,6 @@ char *cst_parliament_status_text(void) {
                    svc_id[0] ? svc_id : "-", svc_port);
   else
     cst_buf_puts(&b, "service     stopped\n");
+  cst_buf_puts(&b, "peer_sync   sealed (X25519 + XChaCha20-Poly1305)\n");
   return cst_buf_steal(&b);
 }