#498 feat(dash): copy pending approval details

[Anonymous]

Originally created by: slegarraga

Closes [#443]

Pull Request

Slice

• Repo: doberman-core
• Feature / Slice: [#443] — Copy details from pending-approval cards
• Plan reference: issue [#443]

What this PR does

• Adds a neutral Copy details button beside each card's existing Approve/Deny actions.
• Copies formatted JSON containing only id, tier, risk, action_type, reason_codes, and explanation from the already-redacted /api/pending row.
• Handles unavailable or rejecting clipboard APIs without disrupting the approval card.
• Documents the review-handoff workflow in the README.
• Adds the required changelog.d/498.md release fragment.

Tests added (run in CI)

• Extends test_dash_polish.py to verify the button is served, the clipboard write is defensive, all six allowed fields are present, and no target/path field enters the copied block.
• Targeted dashboard polish suite: 18 passed.
• ruff check . and ruff format --check .: passed (401 files formatted).
• Markdown links: 43 files checked, no broken internal links.
• Import contracts: 4 kept, 0 broken.
• Parity generation check: passed.
• Full sequential suite reached 100% with 90.68% coverage. Its only failure is the existing real-plugin installation test (ModuleNotFoundError: doberman inside the isolated plugin environment); the same failure reproduces unchanged from a clean origin/main worktree on Python 3.13.

Public-release safety (doberman-core only)

• [x] Contains nothing from the "not allowed" list: no enterprise/hosted code, no proprietary detection, no customer data, no secrets, no commercial-license code
• [x] Core still builds/tests/runs with NO enterprise package installed

Security checklist

• [x] Fails closed on error / uncertainty
• [x] No secret, full file, or unredacted prompt logged or committed
• [x] Any guardrail/learning change is raise-only (no silent loosening; no guardrail/learning behavior changes here)
• [x] Every BLOCK/AUTH carries reason codes + a human explanation (unchanged)
• [x] doberman-core does not import doberman_enterprise

Edge cases covered / Deviations from plan / Risks introduced

• Clipboard API missing or rejecting: caught locally; Approve/Deny remain usable.
• Copy payload is deliberately allowlisted and excludes raw targets and paths.
• No decision-path, redaction, authentication, or endpoint behavior changes.

AI assistance

AI infrastructure assisted with implementation and test review; the resulting diff and validations were reviewed locally.

[Anonymous]

Originally posted by: vinayjagan03

code looks good on visual inspection. all CI tests passed. good to go :)

[Anonymous]

Ticket changed by: vinayjagan03

• status: open --> closed

[Anonymous]

Originally posted by: fu351

Thanks @slegarraga, in as well! Wrapping the clipboard call in async try/catch was the right call, navigator.clipboard can be undefined outside a secure context and a bare .then().catch() would have thrown before the catch ever ran and broken the card. The test that fails if target or path ever sneak into the copy block is the kind I want on every dash change. Next issue suggestion is over on [#461].