docs: flow 2.2.0 reference (hold until 2.2.0 is released)

[abrichr]

Hold this PR. Don't merge it until openadapt-flow 2.2.0 is on PyPI. It goes live the day 2.2.0 is released.

This PR documents what ships in openadapt-flow 2.2.0 and openadapt-agent 2.2.1. That is OpenAdapt main plus the version bump in OpenAdaptAI/OpenAdapt#1209. Until the release, the pages describe behavior that's on main but not yet installable from PyPI.

It's stacked on #267, the launcher and agent help drift check. #266 is merged and is already included. Once #267 merges, change the base to main.

What it adds

• Approvals. Every run under every profile waits on each save unless the operator chooses another mode. By default a person answers. With an approver policy, a delegated agent or system can answer from the CLI, over MCP, or through a signed webhook. Admission stays per workflow.
• MCP tool reference. Which tools each server mode exposes, the authoring tools, and every serve option.
• Record checks. One section covering the system-of-record kinds, candidates, the separate-session read, checks shown by demonstration, the on-screen read-back, and plugin verifiers.
• How strong a read-back is. A table that maps each kind of read-back to its Flow tier, grade, VERIFIED eligibility, certification, and Seal check level. A marked spot is left for the R0–R3 ladder, which will be filled in when the reopen-readback change lands.
• Receipts, Seals, and countersigning (new page). Covers the run receipt, the Seal and how to check it offline, verify-run effect receipts, and countersign: timestamps, the TSA choice, commitments, the vault, the exception queue, and the dossier. The receipt and Seal sections in the files page and the Execute page now link here instead of repeating it.
• Configuration reference. Every backend field, remote-session markers and the frame contract, onscreen and plugin effects, candidates, identity:, idempotency:, require_settled, layout_drift_check, the remote-decision fields, and the 2.2.0 environment variables.
• verify.yaml reference and the one-command qualify campaign.
• Command reference moved to 2.2.0: check, countersign, jit, pull, triage, and verify-run.
• Removes the "on main only" notes for features that ship in 2.2.0: agent recording, countersign disclosure, package folding, and the browser choice.

Command help pins

The pins point at OpenAdapt main at 9104577e and label it as the 2.2.0 and 2.2.1 releases:

• Flow commands. scripts/flow_cli_reference.py (ci(docs): command reference from the released Flow; private name check #265) has FLOW_VERSION = "2.2.0", plus a FLOW_SOURCE that builds from that commit until 2.2.0 is on PyPI. The flow-cli-release job compares the snapshot against that build. The 2.2.0 snapshot has the same commands and options as the build the docs were written against.
• Launcher and agent help. cli-reference/requirements.txt has source pins in the form name @ git+URL # release VERSION. The installed-version check skips those pins.

Not documented yet

The approvals pages describe main as it is now: every run waits on each save unless the operator picks another mode. The decided plan is to admit once, then stop only on problems, with per-save approval as the strictest setting. It lands in OpenAdaptAI/OpenAdapt#1212 and isn't described here. If #1212 merges before 2.2.0, the approvals section, the mode table, and the FAQ answer need updating before this merges.

These open PRs aren't documented either: OpenAdaptAI/OpenAdapt#1231 (surface rule), #1233 (record --verify), #1235 (SMART auth), and #1239 (the read-back ladder). The verification page leaves a marked spot for the ladder.

On release day

1. Set FLOW_SOURCE = None and rerun flow_cli_reference.py snapshot. Change the two source pins to openadapt-flow==2.2.0 and openadapt-agent==2.2.1, then rerun scripts/generate_cli_reference.py. Fix any page the diff touches. #1209 has to merge main before the release, and the help text from docs: fix approval-mode default, agent approval tools, and launcher serve help OpenAdapt#1238 will show up here too.
2. Update the compatibility table and its checker. In 2.2.0, openadapt-flow no longer depends on openadapt-types, and openadapt-agent depends on openadapt-flow.
3. Add the changelog entries, then merge.