docs(dox): build out the DOX AGENTS.md hierarchy

Root Child DOX Index assembled, plus a per-module AGENTS.md across the tree
(core/*, infrastructure/*, apps/*, testing/*, and docs/examples/frontend/etc),
each following the DOX section shape: Purpose, Ownership, Local Contracts,
Work Guidance, Verification, Child DOX Index.

testing/approvals/AGENTS.md

@@ -0,0 +1,31 @@
+# testing/approvals
+
+## Purpose
+
+Verifies the approval gate subsystem: grant semantics, security properties, trigger rules, tier immutability, mode-based approval, and fuzz coverage. Exercises `core:approvals` in isolation and against real event/session plumbing.
+
+## Ownership
+
+Tests in this submodule. Production code lives in `core:approvals`, `core:events`, `core:sessions`, `core:transitions`, `core:validation`, `infrastructure:persistence`.
+
+## Local Contracts
+
+- Approval grants must never couple to tool execution — `NoExecutionCouplingTest` pins this boundary.
+- Tier values are immutable after assignment — `TierImmutabilityTest` pins this.
+- Grant security properties (escalation, scope leakage) pinned by `GrantSecurityTest`.
+- Approval triggers fire on the correct event sequence — `ApprovalTriggerTest` pins this.
+
+## Work Guidance
+
+- `ApprovalFuzzTest` generates random event sequences; seed is fixed for reproducibility — do not change the seed without a clear reason.
+- Suspend tests use `runBlocking { ... }`.
+
+## Verification
+
+```
+./gradlew :testing:approvals:test --rerun-tasks
+```
+
+## Child DOX Index
+
+No child AGENTS.md (leaf module).