test: harden approval-gate CI coverage

[caiwang0]

Summary

• Makes sure SmartHub only allows real setup or config changes after clear user confirmation, while still allowing safe read-only actions and follow-up steps in an already-started setup flow.
• Checks those approval rules both directly and through the real command-line gate, so the shared logic and the actual wrapper behave the same way.
• Verifies the local scenario harness really exercises the setup paths it claims to cover, including discovery-first behavior, confirmation boundaries, and the automation drafting boundary.
• Confirms the setup and integration docs still describe the expected flow and machine boundaries correctly.
• Confirms the validation docs match what the tests actually exercise, including the documented harness command and covered scenarios.

Test Plan

• python3 -m unittest tests.test_p2_scenario_harness -v
• python3 -m unittest tests.test_approval_gate_policy tests.test_approval_gate -v
• python3 -m unittest tests.test_p2_scenario_harness tests.test_approval_gate tests.test_automation_docs tests.test_integrations_docs -v