Approval workflow

Placeholder. Canonical source: outputs/ACCESS_CONTROL.md §“Approval workflow”.

draft ──► needs_review ──► reviewed ──► approved
                                  │
                                  └──► (later) deprecated

Migration notes (re: M-1 audit finding)

When migrating SOPs from raw-index/sop-library/ and raw-index/sources/ into library/src/content/docs/ (Phase 5):

• Do NOT propagate credentials. Specifically, raw-index/sources/dexmate/04_dexmate-vega-sop.txt:46 contains a tablet credential literal. Replace with [REDACTED — see admin for tablet credentials] or equivalent during migration. The actual credential value is intentionally not quoted here — see outputs/STALE_OR_NEEDS_REVIEW.md M-1.
• Do NOT propagate PII. Operator names, contact info, badge numbers, etc., should be replaced with role references or owner handles.
• Verify all [CONFLICT] labels are either resolved or explicitly marked [OPEN — tracked as B-A##] before promoting approval_status past draft.