refactor(ui): one canonical segment control (ChainSegments) everywhere

The same single-select choice pattern appeared as four widgets:
audit's hover pills, the store's SegmentedButton, the store filter
dialog's ChoiceChips, and the approvals TabBar (usertest finding
#14 / night-log decision 'pill segment as canon'). The audit
pattern is promoted to a shared ChainSegments widget (optional
icons, hover, selected border, button+selected semantics) and all
four sites use it; approvals switches lists via IndexedStack so
both stay alive and switching does not refetch.

Guard per the no-bugfix-without-a-guard rule: widget tests for
selection + semantics, plus a canon sweep that bans
TabBar/TabBarView/TabController/SegmentedButton/ChoiceChip from
lib/ (comments exempt). Deliberately out of scope: the flow
editor's Graph/Text/Run tabs live in the separate editor package.
Studio 0.75.0; guide images regenerated, dark + light verified.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

CHANGELOG.md

@@ -6,6 +6,20 @@ lockstep.
 
 ## Unreleased
 
+### Changed (0.75.0)
+
+- **One segment control everywhere.** The same single-select
+  choice pattern used to appear as four different widgets: the
+  audit page's hover pills, the store's Material SegmentedButton
+  (Modules / Studio & Designs), the store filter dialog's
+  ChoiceChips and the approvals page's TabBar. All of them now use
+  the canonical `ChainSegments` pill control (the audit pattern
+  promoted to a shared widget, with icons and a11y semantics);
+  the approvals page keeps both lists alive in an IndexedStack so
+  switching does not refetch. A canon-guard test bans
+  TabBar/SegmentedButton/ChoiceChip from lib/ for good. Guide
+  images + wording updated (dark and light verified).
+
 ### Hardening round (test strategy, 2026-07-19)
 
 - **Hermetic widget suites.** `HubService.instance` is injectable;