feat(ai): enforce single-writer automation router

apps/api/src/services/approval_execution.py

@@ -193,6 +193,18 @@ class ApprovalExecutionService:
         """
         from src.services.notifications import ExecutionStatus
 
+        if self._is_auto_approved_request(approval):
+            logger.error(
+                "auto_approved_direct_execution_blocked",
+                approval_id=str(getattr(approval, "id", "")),
+                incident_id=getattr(approval, "incident_id", None),
+                requested_by=getattr(approval, "requested_by", None),
+                required_executor="awoooi-ansible-executor-broker",
+            )
+            raise RuntimeError(
+                "auto_approved_direct_execution_disabled_use_single_writer_broker"
+            )
+
         logger.info(
             "background_execution_start",
             approval_id=str(approval.id),