xlsx-win v2: implement approved-macro execution and Excel-level AutomationSecurity enforcement

[dachent]

Parent: #33
RFC: #32, amended by RFC 0002
Depends on: #36, #38 (both merged)

Background

#38 built the macro policy (macro_policy.py: exact-match allowlist by workbook hash + entrypoint, disabled by default). #36 explicitly deferred macro execution: the supervisor's run_approved_macro step type is unimplemented, returning MACRO_EXECUTION_DEFERRED by design ("a deliberate, visible failure, not a silent no-op"). #39's macro_enabled corpus item confirmed (its own description says so explicitly) that nothing currently proves a genuinely macro-bearing workbook is treated differently from a plain one at Excel/COM execution time, or that Excel-level AutomationSecurity actually rejects an unapproved macro -- only that an unrelated, content-independent Python allowlist lookup returns False against an empty list.

Scope

• Implement run_approved_macro: re-enable macros (e.g. AutomationSecurity = msoAutomationSecurityByUI) only around the specific approved call, using macro_policy.is_macro_approved as the actual gate before ever calling Application.Run(...).
• A real, positive test: an approved macro on the allowlist actually executes.
• A real, negative test: an unapproved macro is rejected at the COM/execution layer, not just by the existing Python-side allowlist check -- i.e., prove AutomationSecurity genuinely blocks it even if something upstream mistakenly tried to run it.
• Decide and document the exact AutomationSecurity value and re-disable timing (must not leave macros enabled for anything beyond the single approved call).

Acceptance criteria

• Approved macro (exact workbook hash + entrypoint match) executes successfully via run_approved_macro.
• Any other macro name/workbook combination is rejected before execution, both by the Python policy check and by Excel's own security setting if the Python check were ever bypassed.
• Macros are disabled again immediately after the approved call completes, regardless of success or failure.