docs(security): add approval review packet contract [skip ci]

docs/security/security-approval-gate.snapshot.json

@@ -266,6 +266,7 @@
   ],
   "decision_recording_rules": [
     "每個 gate item 必須記錄人工決策、reviewer、時間、evidence refs 與批准範圍。",
+    "每個 gate item 可被包成 security_approval_review_packet_v1，但 review packet 不代表批准。",
     "批准只代表該 scope 可進下一步設計、草案、只讀 inventory 或人工 exception；不代表可立即執行 runtime action。",
     "任何 scan、/execute、repo、refs、deploy、secret、RBAC、NetworkPolicy、firewall 變更都需要 follow-up runtime gate。",
     "拒絕、延後或要求補 evidence 時，只更新 gate 狀態與 audit evidence，不觸發修復。"