docs(qa): correct five approvals checklist items against the #7517 run (#7638)

Five authoring defects surfaced by the full approvals area run — in every
case the build behaves correctly and the checklist was wrong.

- decision-action-matrix: resubmit does NOT move the original returned->pending;
  the approval node's re-entry mints a round-N+1 request while the original
  stays terminally returned. Split into three clauses and named the oracle.
- dynamic-approver-routing: the vars clause named an unreadable oracle (a
  paused run's detail carries no variables key); it now asserts the functional
  resolution — stage-2 pending_approvers cardinality and order across a 1-pick
  and a 2-pick run.
- ooo-delegation-reroute: the prescribed third-party delegation is not
  constructible (sys_approval_delegation is self-service-only, no admin
  exemption since #4839). Rewritten around the admin delegating their OWN slot
  to a second REAL runtime account that decides with its own bearer token.
- knownGaps now record the better-auth issuer=local:credential provisioning
  detail on the three items that need a real second persona.
- notification-deep-link: fixtures re-anchored on the remind/reassign path (no
  approval.opened topic exists), and the cold-load clause's evidence restated
  observably — the console consumes the query param.

Refs #7517


Claude-Session: https://claude.ai/code/session_01JJXyzuEo8JoAGLQLDXA54D

Co-authored-by: Claude <noreply@anthropic.com>

Author: huangyiirene