[sec-bus] approval: engine inputs and reads the host gate still decides (Unknown origin, require_approval, forced, detached, recent decisions, human-ticket flow trust)

Change

Gaps that keep the host's origin matrix and store alive:

Origin::Unknown handling; require_approval: true overriding allowlists; the forced approval that is one-time only and only for WebChat; detached/sub-agent classification as an engine input (or document that it stays host-side).
A read path for recent decisions across scopes (host list_recent_decisions), purge_session, and a session_id correlation field on rows.
Sanitized audit_error (through the redactor) on stored rows.
PreauthorizeFlow2 / flow trust should require a VerifyHuman receipt: today OpenHuman's approval_preauthorize_flow RPC lets any caller grant persistent flow trust for any flow_id, and flow trust beats require_approval (epic note N9).
Decide whether a park-bound expiry should CancelApproval2 the row (host bug leaf B1 item 2).

Paths are relative to crates/openhuman-core/src/ in tinyhumansai/openhuman at main ae18f8b769.

File	Lines	Verdict	Target	Reason
`security/approval/gate_intercept.rs`	751	REIMPLEMENT	`tinysecurity_approval::Engine::begin` (`engine.rs:417`), `engine_flow_trust.rs`, `engine_tool_trust.rs`	~60% origin decision matrix (cron deny, SaaS, forced-only-WebChat, flow trust, auto_approve_all, allowlist). Park registration (~40%) stays. Gaps: `Origin::Unknown`, `require_approval` overriding allowlist, `forced` one-time rule, `detached` as engine input. (branch: partial)
`security/approval/store.rs`	221	REIMPLEMENT	`Engine::{begin,decide,consume,record_execution,list,expire}` over host `ApprovalStore2{Load,Cas}`	Passthrough + expire_stale. Gap: `list_recent_decisions` read path. (branch: partial)
`security/approval/store_documents.rs`	487	REIMPLEMENT	`Engine` CAS lifecycle over `ApprovalStore2`	Keep ~100-line Load/Cas adapter. Gaps: `purge_session`, `session_id` correlation, sanitized `audit_error`. (branch: partial)

None.

The capability above is merged to the canonical repository's main with tests, and (for a release leaf) published with a checksum.toml.
The repository's own CI is green on Linux, macOS and Windows.
OpenHuman's matching host rows can be deleted against this release (tracked by the adoption leaf).

Files to consider: the rows above and the OpenHuman host code they replace (paths in the rows).
Research: the gaps and line references in the Change section; re-read each cited line on current main before editing, the audit is a snapshot.
Workflow: an implementing-an-epic step for Tracker: security, policy, approvals and sandboxing onto tinysecurity + tinybox (file-by-file migration epic) tinyhumansai/openhuman#8369. Follow migrate-to-submodule (bus contract only, upstream PR first, release, then digest re-pin from the published checksum.toml).
Subagent: tdd-implementer.

Merged in #16 (b8c6229)