Module-scoped credential namespace not resolved in write approval path

Reproduction steps:

1. Install a signed custom module with a credential_spec provider that collides with an existing catalogue provider. In my case:

module: dave/paypal-vendor-payments
logical provider: paypal

1. Declare a write command with:

mode=write_requires_approval

1. Station correctly creates the effective module credential namespace:

dave-paypal-vendor-payments::paypal

1. Save the required credentials using that effective namespace. Native vault save succeeds.
2. Inside the loaded module, vault_get("paypal") resolves correctly through the module-scoped namespace mapping.
3. Stage the write command. Staging succeeds.
4. Attempt to approve the staged command through the native approval path.

Expected:

The approval/status resolver should apply the same module-scoped credential mapping used by the module loader, resolve the credential under:

dave-paypal-vendor-payments::paypal

and classify the command as:

available_write_requires_approval

The command should then proceed through the normal Airlock approval flow.

Actual:

approve_command() returns:

this command does not require approval

Tracing the path:

routes/commands.py::approve_command()
→ studio_server.py::resolve_status_for()
→ command_registry.py::resolve_status()

shows that the status/approval resolver checks the bare logical provider "paypal" instead of the effective module-scoped provider namespace.

The module loader itself does apply the mapping correctly, so vault_get("paypal") works inside the module.

I also compared this against a working approval-controlled Stripe module. The custom module manifest and command registration are valid, the module is signed and installed successfully, and the credentials are present in the native vault.

No RailCall source was modified and Airlock was not bypassed.