docs: scrub self-ref cookies across 5 files (#719 batch 2)

All five files scrubbed to 0 issue-ref cookies. Most refs were
'(closes #NNN)' style attribution after closed work landed.

- docs/turn-loop.md: 6 → 0 (#598 unified binary, #419 auth-fail,
  #542 mtime resumption, #519 role markers, #442 spawn path,
  #474/#478 partial edit)
- docs/approvals.md: 5 → 0 (#317 flake validation, #250 withdraw,
  #441 rebuild-queue dispatch, #753 manager port hash, #425
  crash-watch grace)
- docs/terminal-rendering.md: 2 → 0 (#666 ask-operator inline)
- docs/conventions.md: 3 → 0 (#753 port hash, #692 parent
  sentinel, #486 reparenting)
- docs/security.md: 4 → 0 (#240 + #658 ×2 + #673/#678 attribution)

Combined with PR #810 (docs/web-ui.md 14→0), this PR closes the
small / medium files. Remaining: agent-hierarchy.md (13),
gotchas.md (13), persistence.md (13). gateway.md is atlas's lane.

docs/approvals.md

@@ -30,7 +30,7 @@ happens after a decision lands.
    applied.
 3a. **Flake validation (ApplyCommit only):** after the proposal tag
    is planted, hive-c0re reads `proposal/<id>:flake.lock` and
-   runs two checks (closes #317). If either check fails, no
+   runs two checks. If either check fails, no
    pending approval is created for the operator — the row is
    marked failed and surfaces on the dashboard with the
    validation message:
@@ -66,7 +66,7 @@ happens after a decision lands.
 ### Withdrawing a pending approval
 
 The manager can call `cancel_loose_end(kind: "approval", id)` to
-withdraw an approval that hasn't been acted on yet (closes #250).
+withdraw an approval that hasn't been acted on yet.
 The row transitions to `ApprovalStatus::Cancelled` (distinct from
 `Denied`/`Failed`), the dashboard pulls the card out of the
 pending pane, and `ApprovalResolved { status: "cancelled" }` fires
@@ -202,7 +202,7 @@ approval id to retry. Because tags are first-class git objects,
 rejected and failed trees stay browsable forever — `git log
 --tags` in the applied repo is the audit trail.
 
-### Dispatch via `rebuild_queue` (#441)
+### Dispatch via `rebuild_queue`
 
 Long-running approval work — `ApplyCommit`, `UpdateMetaInputs`,
 `Spawn` — no longer runs inline inside `actions::approve`. Instead
@@ -344,7 +344,7 @@ Differences from sub-agents:
   (vs `agent-base`).
 - Container name is `hm1nd` (no `h-` prefix).
 - Web UI port via `lifecycle::agent_web_port("hm1nd")` — same
-  FNV-1a hash as every other agent (8100..8999 range) since #753.
+  FNV-1a hash as every other agent (8100..8999 range).
 - `set_nspawn_flags` adds two extra binds: `/var/lib/hyperhive/agents`
   → `/agents` (RW) so the manager can edit per-agent proposed repos,
   and `/var/lib/hyperhive/applied` → `/applied` (RO) so the manager
@@ -424,8 +424,8 @@ regular claude turn so the manager can react. Variants
   such transient was cleared in the last 30s (`RECENT_TRANSIENT_GRACE`
   tombstone, three `POLL_INTERVAL`s — closes the race where a
   lifecycle op finishes between two crash-watch polls and the
-  container shows briefly as "stopped without transient" before the
-  next start, #425). Manager can `start` it again or escalate.
+  container shows briefly as "stopped without transient" before
+  the next start). Manager can `start` it again or escalate.
 - `NeedsLogin { agent }` — sub-agent has no claude session yet.
   Manager can't act directly (interactive OAuth); typically flags
   the operator.