fix(oracle-l6-r2): provenance + approvals preview + llm off pill

Oracle PASS→FAIL flip identified three blockers; closing all three.

1. Provenance — pushed sha-4c46c03b + this commit to canonical
   shad/canvas-frontend (was at sha-7ceb5c05 last time Oracle looked).
2. Approvals execution — added an explicit yellow runtime-note above
   the action row explaining runtime-values is offline in this env.
   Action button label now ends in '· preview' and the title attribute
   says 'Disabled in this environment'.
3. LLM proxy provider state — Agent sidebar now probes
   /internal/canvas-llm/chat on mount; renders 'LLM provider · OFF'
   pill + a one-line hint (set OPENAI_API_KEY / ANTHROPIC_API_KEY).
   Replaces the previous sub-text that buried the off state.

src/index.css

@@ -2121,3 +2121,23 @@ select.studio-input { background: var(--bp-paper); }
   .docs-split { grid-template-columns: 1fr; }
   .docs-rows { max-height: 50vh; }
 }
+
+.approvals-runtime-note {
+  padding: 10px 12px;
+  background: color-mix(in srgb, var(--bp-amber) 14%, var(--bp-paper));
+  border: 1px solid color-mix(in srgb, var(--bp-amber) 40%, var(--bp-navy));
+  font-size: 12px;
+  line-height: 1.4;
+  color: var(--bp-navy);
+}
+
+.agent-llm-state { margin-top: 10px; display: flex; flex-direction: column; gap: 4px; }
+.agent-llm-pill {
+  display: inline-block; padding: 2px 8px;
+  font-family: var(--bp-mono); font-size: 10px; letter-spacing: 0.06em;
+  border: 1px solid var(--bp-navy); align-self: flex-start;
+}
+.agent-llm-on { background: color-mix(in srgb, #2e7a25 35%, var(--bp-paper)); color: var(--bp-paper); }
+.agent-llm-off { color: var(--bp-muted); }
+.agent-llm-unknown { color: var(--bp-muted); }
+.agent-llm-hint { font-size: 11px; color: var(--bp-muted); line-height: 1.4; }