fix(flow): REST identity follows the gates state; VS Code rejections carry provenance

Review round 19:

- An undo across a newer run's start restored the previous run's
  identity in the undoable state while the world-time gates kept the
  newer run's records. The REST route now prefers the gates state's
  identity, which is by construction the one the retained records
  belong to (identical for a live run).
- VS Code's No now resolves with selectedLabel: 'Reject', so a real
  click keeps writing the gate audit while a bare transport-failure
  rejection stays unobserved.

apps/vscode/src/runtime/reverse-rpc.ts

@@ -60,7 +60,10 @@ export class ReverseRpcController {
     } else if (response === "approve") {
       resolve({ decision: "approved" });
     } else {
-      resolve({ decision: "rejected" });
+      // The label proves a user actually clicked No — a bare rejection is
+      // reserved for transport failures, which flow-gate provenance treats
+      // as unobserved and refuses to record as a human verdict.
+      resolve({ decision: "rejected", selectedLabel: "Reject" });
     }
     return true;
   }

packages/kap-server/src/routes/flow.ts

@@ -67,8 +67,8 @@ export function registerFlowRoutes(app: FlowRouteHost, deps: FlowRouteDeps): voi
       const payload: FlowStateResponse = {
         run: {
           active: run.active,
-          flow_id: run.flowId ?? gates.flowId,
-          task: run.task ?? gates.task,
+          flow_id: gates.flowId ?? run.flowId,
+          task: gates.task ?? run.task,
           stages: run.stages?.map((stage) => ({
             id: stage.id,
             objective: stage.objective,