Tiered autonomy: assisted and auto modes per source

[vnmoorthy]

ApprovalGate already models manual | assisted | auto but only manual is wired. Design + implement graduation:

• assisted: auto-approve heals with validation confidence ≥ a per-source bar (default 95%) AND all field match rates = 100%; notify via webhook; anything below the bar waits for a human.
• auto: approve, deploy, notify, and arm instant rollback (the pointer move already exists).
• Trust must be earned per source: N consecutive human-approved heals unlock assisted; a rejection or rollback demotes back to manual.

Needs an ADR: what counts as a demotion event, and how the audit ledger records machine-approved deploys (actor = gate:assisted + the policy version?).