Update agent-run tests for lease-free worker

Drop the lease, heartbeat, and stale-recovery test coverage that no
longer applies, and add coverage for the new behaviour: graceful
suspend returning a run to PENDING, an approval interruption parking it
in AWAITING_APPROVAL, and SubmitApproval merging decisions and
requeuing the run. Exercise the submitAgentRunApproval mutation end to
end, including the authorization paths for the relocated policies.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/agentrun/service_test.go

@@ -21,6 +21,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.probo.inc/probo/internal/test"
+	"go.probo.inc/probo/pkg/agent"
 	"go.probo.inc/probo/pkg/agentrun"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/gid"
@@ -81,6 +82,23 @@ func TestService_ListForOrganizationID(t *testing.T) {
 	assert.True(t, ids[runB.ID])
 }
 
+func TestService_SubmitApproval_NotAwaitingApproval(t *testing.T) {
+	client := test.PGClient(t)
+	svc := agentrun.NewService(client)
+
+	// A freshly inserted run is PENDING, not AWAITING_APPROVAL.
+	run := insertPendingRun(t, client, "service-approval-agent", nil)
+
+	_, err := svc.SubmitApproval(
+		context.Background(),
+		coredata.NewNoScope(),
+		run.ID,
+		map[string]agent.ApprovalResult{"tc_x": {Approved: true}},
+	)
+	require.Error(t, err)
+	assert.ErrorIs(t, err, agentrun.ErrNotAwaitingApproval)
+}
+
 func TestService_CountForOrganizationID(t *testing.T) {
 	client := test.PGClient(t)
 	svc := agentrun.NewService(client)