authorize --close for the scheduled reconciliation sweep (#2106)
vrg-epic-audit --close was human-only (refused for any non-human identity). The scheduled reconciliation sweep (ops-epic-sweep) runs in CI as the automation app, not a human, so it needs an explicit trusted path. Allow --close when VRG_EPIC_SWEEP=1 (set only by the sweep workflow) in addition to a human; interactive agent sessions still can't close. The sweep only closes provably-complete drift, so authorizing it is safe. Part of epic vergil-project/.github#80 (automated reconciliation sweep).