feat(approvals,runs): explain approvals in place + one-click hub update (0.81.0)

Approvals: the pending card now shows its full origin — flow, step,
run id (previously dropped at the Dart mapping layer), project, and
requested-at — under an ORIGIN heading, led by a one-line intro strip
that says what the inbox is and what Approve/Reject do. Approve/Reject
buttons carry tooltips; the history dialog gains project + run id.
Fixes the approvals doc drift (title/details/reviewer ->
prompt/show/timeout_seconds). Guard: approvals_origin_test renders the
card via the hermetic fake hub and pins every origin fact.

Runs: the "hub too old" state now leads with an in-place update button
(same `chain update apply` path as the Diagnose page), the Diagnose
deeplink demoted to secondary, with a CLI-absent fallback. Guard: two
new RunsLoadErrorView widget tests.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

assets/docs/approvals.md

@@ -15,7 +15,9 @@ Add an approval step before:
 - anything the operator's compliance owner asked you to gate
 
 The approval is a recorded event — every approval shows up in
-the audit log with the reviewer, decision, and reason.
+the audit log with the reviewer, decision, and reason. The
+`prompt` is the sentence the reviewer sees; `show` selects the
+data put in front of them (a prior step's output).
 
 ## How a flow declares one
 
@@ -27,9 +29,8 @@ steps:
   - id: review
     use: system.approval@^0
     with:
-      title: "Review the classifier output"
-      details: "$classify.response"
-      reviewer: "$inputs.reviewer"
+      prompt: "Review the classifier output"
+      show: "$classify.response"
       timeout_seconds: 600
 
   - id: write
@@ -45,8 +46,9 @@ configured `timeout_seconds` elapses.
 
 ## How an operator answers one
 
-The Approvals page lists every pending approval. Click an
-entry, read the title + details, decide:
+The Approvals page lists every pending approval. Each card
+shows its origin (flow, step, run, project, requested-at), the
+`prompt`, and the `show` data. Read them, then decide:
 
 - **Approve** — the flow resumes from this step with the
   approval's `payload` as the step output.
@@ -63,7 +65,7 @@ that reflects how long a reviewer can realistically take.
 
 Every approval write hits the audit log:
 
-- approval requested (with the title + details snapshot)
+- approval requested (with the prompt + show-data snapshot)
 - reviewer-decision recorded (with reason on reject)
 - payload + signature on accept