docs: scrub self-ref cookies across 5 files (#719 batch 2)

All five files scrubbed to 0 issue-ref cookies. Most refs were
'(closes #NNN)' style attribution after closed work landed.

- docs/turn-loop.md: 6 → 0 (#598 unified binary, #419 auth-fail,
  #542 mtime resumption, #519 role markers, #442 spawn path,
  #474/#478 partial edit)
- docs/approvals.md: 5 → 0 (#317 flake validation, #250 withdraw,
  #441 rebuild-queue dispatch, #753 manager port hash, #425
  crash-watch grace)
- docs/terminal-rendering.md: 2 → 0 (#666 ask-operator inline)
- docs/conventions.md: 3 → 0 (#753 port hash, #692 parent
  sentinel, #486 reparenting)
- docs/security.md: 4 → 0 (#240 + #658 ×2 + #673/#678 attribution)

Combined with PR #810 (docs/web-ui.md 14→0), this PR closes the
small / medium files. Remaining: agent-hierarchy.md (13),
gotchas.md (13), persistence.md (13). gateway.md is atlas's lane.

docs/conventions.md

@@ -10,7 +10,7 @@ exist because something already went wrong without them.
 - The manager is `hm1nd` (no `h-` prefix, fixed name).
 - `MAX_AGENT_NAME` in `lifecycle.rs` enforces the cap.
 - Per-agent web UI port = `WEB_PORT_BASE + FNV1a(name) % WEB_PORT_RANGE`
-  (8100..8999) for every agent including the manager (#753); dashboard
+  (8100..8999) for every agent including the manager; dashboard
   `cfg.dashboardPort` (default 7000).
 
 ## Identity = socket
@@ -32,12 +32,12 @@ angle-bracket and asterisk shapes below are structurally safe.
   (`agent_server::handle_send` fans out via `Coordinator::broadcast_send`).
 - `operator` — the human at the dashboard. Messages accumulate in the
   inbox view; no agent ever `recv`'s them.
-- `<parent>` — the sender's parent per `topology.json` (`#692`).
-  Rewritten at send time by `topology::resolve_recipient`: looks up
+- `<parent>` — the sender's parent per `topology.json`. Rewritten at
+  send time by `topology::resolve_recipient`: looks up
   `parent_of(sender)` and falls back to `operator` when the sender is
   a root agent (or absent from topology entirely). Lets agents address
   their parent without learning the label, so runtime reparenting
-  (`#486`) propagates with zero agent-side restart.
+  propagates with zero agent-side restart.
 
 When the resolver rewrites `<parent>`, the broker stores the
 *resolved* label as the message's recipient — the dashboard and