Docs/1391 approval authority

[Lkx-JY]

Which issue or RFC does this PR close?

Relates to #1391.

This PR does not automatically close the issue. Maintainers should confirm whether the documented approval contract resolves the report.

Rationale for this change

Some documentation states that a model cannot approve its own Candidate. The implemented contract requires a separate approval operation, but an Agent with review authority can call that operation.

This PR follows the documentation-alignment approach described in #1391. It clarifies the distinction between explicit approval, permission checks, independent review, and human confirmation.

Deployments that reserve approval for a person must use separate Agent and reviewer identities, keep reviewer credentials outside the Agent environment, and withhold review authority from the Agent.

Mandatory human confirmation and a prohibition on self-approval remain outside this PR. Either capability would require a separate proposal if the project chooses to support it.

What changes are included in this PR?

• Align the English, Chinese, and Japanese READMEs, bilingual guides, and related RFCs with the implemented approval contract.
• Explain default trusted access, enforced scope.review, and advisory MCP annotations.
• Document role-assignment requests, credential separation, rejection and resubmission, and permission limits for replacing existing Artifacts.
• Add six acceptance cases covering HTTP/MCP authorization, approved Artifact readback, recall boundaries, rejection and resubmission, and self-approval when review authority is granted.

Are there any user-facing changes?

Documentation now explains how to separate Agent submission from reviewer approval.

Review does not inherently prove human confirmation or require a different proposer and reviewer. Existing automated approval remains available to authorized callers.

Runtime behavior, public APIs, configuration, and persisted formats are unchanged. No migration is required.

How was this change tested?

.venv/bin/python -m pytest -q \
  tests/e2e/test_candidate_review_authority.py \
  tests/e2e/test_candidate_review.py \
  tests/test_mcp.py \
  tests/test_access_mcp.py

make check
make docs-test
git diff --check

Results:

• Python tests: 20 passed, 1 skipped. The skipped case requires a configured OceanBase database.
• make check: passed.
• make docs-test: passed, including verification of 940 exported public pages and their internal links.
• git diff --check: passed.

The new cases use temporary SQLite storage, the built-in authorization provider, a test Authentication Provider, and in-process HTTP/MCP transports. They do not validate an external identity provider or confirmation prompts in an Agent host.

AI usage statement

Prepared with OpenAI Codex. Codex edited the documentation, added the acceptance tests, and executed the listed validation commands.

[hireview001]

LGTM