Fail an approval request fast when no subscriber received the prompt

client/internal/auth/sessionwatch/watcher.go

@@ -76,13 +76,15 @@ var (
 // owned by sessionwatch, not the caller.
 type StatusRecorder interface {
 	SetSessionExpiresAt(deadline time.Time)
+	// PublishEvent reports whether any subscriber received the event; the
+	// watcher does not act on it.
 	PublishEvent(
 		severity cProto.SystemEvent_Severity,
 		category cProto.SystemEvent_Category,
 		message string,
 		userMessage string,
 		metadata map[string]string,
-	)
+	) bool
 }
 
 // Watcher observes the latest session deadline and fires two warnings

client/internal/auth/sessionwatch/watcher_test.go

@@ -64,7 +64,7 @@ func (r *fakeRecorder) PublishEvent(
 	message string,
 	_ string,
 	metadata map[string]string,
-) {
+) bool {
 	r.mu.Lock()
 	defer r.mu.Unlock()
 	r.events = append(r.events, event{
@@ -74,6 +74,7 @@ func (r *fakeRecorder) PublishEvent(
 		message:  message,
 		meta:     metadata,
 	})
+	return true
 }
 
 func (r *fakeRecorder) snapshot() []event {