Add human-in-the-loop governance workflow tutorial

[cdcavell]

Summary

Adds the Milestone 8 learning material for human-in-the-loop governance workflows.

This change introduces a new governance tutorial that explains how consequential workflows can pause for human review without turning a generic approval action into a bypass around policy or host-owned execution.

The tutorial covers:

• Human review as an explicit pending governance state.
• Separation between acknowledgment, approval, authorization, governance decisions, override authority, and execution authority.
• Reviewer identity, eligibility, role, and scope.
• Separation of requester and approver where required.
• Multi-reviewer, quorum, and dual-control concepts.
• Binding human dispositions to an exact proposed intent.
• Request modification and supersession during review.
• Policy-compliant approval versus explicit override.
• Non-overridable policy outcomes.
• Delegated review and reviewer unavailability.
• Review timeout, cancellation, withdrawal, and reject/resubmit workflows.
• Policy drift and context drift during the review window.
• Revalidation before execution.
• Least-privilege authority after approval.
• Reviewer rationale, reason codes, decision provenance, and audit residue.
• Race conditions and lifecycle state transitions.
• Decision-table and invariant testing for pending, rejected, expired, stale, and revalidated workflows.
• Human review in risk-based and AI-assisted execution paths.
• Cases where a simpler confirmation or ordinary authorization model remains preferable.

The change also:

• Adds the tutorial to Governance navigation.
• Updates the Governance landing page.
• Marks the Milestone 8 Human-in-the-loop workflows roadmap item complete under issue [Learning]: Add human-in-the-loop governance workflow tutorial #113.

The core architectural boundary remains:

Human participation is another governed boundary, not an escape hatch around governance.

A valid human approval can satisfy a review requirement, but current policy and context must still be revalidated before narrowly scoped host-owned execution proceeds.

Closes#113