Port OA approval form-schema / forecast-process / create-instance from main via DeclareLeafMetadata and mapping-ledger exclusions; keep retired schema pin paths deleted and preserve the CI auth/keychain split. Co-authored-by: Cursor <cursoragent@cursor.com>