Make HITL approval file updates atomic with write-to-temp + os.replace

[dannywillowliu-uchi]

Priority: 5.8

HITL approval file writes are not atomic. A crash mid-write leaves corrupted approval state. Use write-to-temp + os.replace pattern.