feat(module21): complete five-day local course evidence

[senih25]

Purpose

Complete the missing local Kaggle Day 4 human-in-the-loop exercise and replace the premature Module 21 closure with an evidence-accurate five-day course record.

Details

• Adds a scaffolded, local-only ADK expense approval workflow.
• Auto-approves synthetic requests up to a fixed threshold.
• Requires explicit human approve/reject input above the threshold.
• Records Day 4 security and HITL evidence.
• Distinguishes curriculum completion from optional cloud labs and capstone eligibility.

Affected areas

• core: deterministic ADK workflow under experiments/
• tests: local HITL and decision tests
• docs: Day 4 evidence and five-day closure records

Validation

• Expense workflow: 6 passed
• Existing Day 4 security guardrails: 4 passed
• Both agent modules: py_compile passed
• Agents CLI: deployment target none
• Blocked-path scan: passed
• Secret-pattern scan: passed
• Staged diff check: passed

Output impact

Adds a public-safe synthetic expense approval prototype and corrects Module 21 completion claims. No existing runtime integration is changed.

Safety

• No PHI or personal expense data
• No secrets, credentials, tokens, or .env
• No cloud deploy, API enablement, IAM, or Secret Manager
• No public endpoint or billing-impacting action
• Optional Day 5 cloud labs remain deferred
• Capstone, badge, and certificate are not claimed

Checklist

• Logic is deterministic
• No unnecessary recomputation
• Cache usage considered and not needed
• Output structure consistent
• Tests added or updated
• Existing flows preserved
• System remains reproducible

Manual review

• Confirm experimental ADK resumability is acceptable for a local learning prototype.
• Confirm course closure wording does not imply capstone submission or cloud deployment.
• Confirm Module 21 remains Needs manual review for live cloud work.