fix(#1953): gate approval cancel on submitter ownership + document submitter_of errors

hive-c0re/src/approvals.rs

@@ -136,6 +136,11 @@ impl Approvals {
     /// The agent that submitted approval `id` (the authenticated socket
     /// caller at submit time). `None` for legacy rows predating the
     /// `submitter` column — callers route those to the root agent.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if the sqlite prepare/query fails. A missing row
+    /// or a `NULL` submitter is not an error — both yield `Ok(None)`.
     pub fn submitter_of(&self, id: i64) -> Result<Option<String>> {
         let conn = self.conn.lock().unwrap();
         let submitter: Option<String> = conn