feat(requirements): support allowed_approval_reviewers

[owenlin0]

Description

Add requirements.toml support for allowed_approvals_reviewers = ["user", "guardian_subagent"], so admins can now restrict the use of guardian mode.

Note: If a user sets a reviewer that isn’t allowed by requirements.toml, config loading falls back to the first allowed reviewer and emits a startup warning.

The table below describes the possible admin controls.

Admin intent	requirements.toml	User config.toml	End result
Leave Guardian optional	omit allowed_approvals_reviewers or set ["user", "guardian_subagent"]	user chooses approvals_reviewer = "user" or "guardian_subagent"	Guardian off for user, on for guardian_subagent + approval_policy = "on-request"
Force Guardian off	allowed_approvals_reviewers = ["user"]	any user value	Effective reviewer is user; Guardian off
Force Guardian on	allowed_approvals_reviewers = ["guardian_subagent"] and usually allowed_approval_policies = ["on-request"]	any user reviewer value; user should also have approval_policy = "on-request" unless policy is forced	Effective reviewer is guardian_subagent; Guardian on when effective approval policy is on-request
Allow both, but default to manual if user does nothing	allowed_approvals_reviewers = ["user", "guardian_subagent"]	omit approvals_reviewer	Effective reviewer is user; Guardian off
Allow both, and user explicitly opts into Guardian	allowed_approvals_reviewers = ["user", "guardian_subagent"]	approvals_reviewer = "guardian_subagent" and approval_policy = "on-request"	Guardian on
Invalid admin config	allowed_approvals_reviewers = []	anything	Config load error