docs(security): add approval state transition contract [skip ci]

docs/security/security-approval-decision-record.snapshot.json

@@ -8,6 +8,7 @@
     "docs/security/security-approval-gate.snapshot.json",
     "docs/security/security-approval-queue.snapshot.json",
     "docs/security/security-approval-review-packet.snapshot.json",
+    "docs/security/security-approval-state-transition.snapshot.json",
     "docs/security/security-mirror-status-rollup.snapshot.json"
   ],
   "summary": {
@@ -25,6 +26,7 @@
   "recording_rules": [
     "每筆人工決策都必須引用 security_approval_gate_v1 的 gate_id 與 source_queue_item_id。",
     "若決策來自 security_approval_review_packet_v1，需在 notes 或 evidence refs 保留 packet_id 的稽核關聯。",
+    "決策後的 next state 必須依 security_approval_state_transition_v1 顯示，且不得授權執行。",
     "approve_scope 只代表批准該 scope 進下一步設計、草案、只讀 inventory、低噪音 scope 或人工 exception；不代表可立即執行。",
     "所有 decision record 都必須維持 execution_authorized=false。",
     "任何批准後的 scan、/execute、repo、refs、deploy、secret、RBAC、NetworkPolicy、firewall 變更都必須另有 follow-up runtime gate。",