feat(approvals,runs): explain approvals in place + one-click hub update (0.81.0)

Approvals: the pending card now shows its full origin — flow, step,
run id (previously dropped at the Dart mapping layer), project, and
requested-at — under an ORIGIN heading, led by a one-line intro strip
that says what the inbox is and what Approve/Reject do. Approve/Reject
buttons carry tooltips; the history dialog gains project + run id.
Fixes the approvals doc drift (title/details/reviewer ->
prompt/show/timeout_seconds). Guard: approvals_origin_test renders the
card via the hermetic fake hub and pins every origin fact.

Runs: the "hub too old" state now leads with an in-place update button
(same `chain update apply` path as the Diagnose page), the Diagnose
deeplink demoted to secondary, with a CLI-absent fallback. Guard: two
new RunsLoadErrorView widget tests.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

CHANGELOG.md

@@ -6,6 +6,28 @@ lockstep.
 
 ## Unreleased
 
+### Changed (0.81.0)
+
+- **Approvals explain themselves.** The pending approval card now
+  leads with a one-line intro strip (what this inbox is; that
+  Approve resumes the flow and Reject stops it with a reason) and
+  carries a proper ORIGIN block: flow, step, **run id** (previously
+  dropped at the Dart mapping layer), project, and requested-at —
+  so a reviewer can see where a request comes from and why. The run
+  id is copyable; the same facts appear in the history dialog.
+  Approve/Reject buttons gained tooltips. Fixed the approvals doc
+  drift — the guide showed `title`/`details`/`reviewer`, which the
+  engine never accepted; it now documents `prompt`/`show`/
+  `timeout_seconds`. Guard: `approvals_origin_test` renders the card
+  through the hermetic fake hub and pins every origin fact.
+- **Update the hub straight from the runs page.** The "this view
+  needs a newer hub version" state now leads with an in-place
+  *Update hub now* button (the same `chain update apply` path as the
+  Diagnose page) instead of only deep-linking to Diagnose; the
+  Diagnose link stays as the secondary escape hatch, and a missing
+  local CLI falls back to it. Guard: two new `RunsLoadErrorView`
+  widget tests.
+
 ### Added (0.80.0)
 
 - **Ollama joins the host services.** Ollama-backed store entries