docs(approvals): drop tracker-tag refs; add topology.rs pointer for role

Remove three bare #NNN tracker-tag references in docs/approvals.md
(hive-rules: no #NNN in code/comments/docs):

- Step 6 of end-to-end flow: "tracked in #1953" → "a known limitation
  under active development"
- InitConfig paragraph: same rewrite
- Helper events section: same rewrite

Also add a code pointer for `can_manage_top_level_agents`: the role is
defined as ROLE_CAN_MANAGE_TOP_LEVEL_AGENTS in hive-c0re/src/topology.rs,
now noted inline so reviewers can verify the name is real.

docs/approvals.md

@@ -69,8 +69,8 @@ informed about what happens after a decision lands.
    ApplyCommit kind) land in the root agent's inbox, carrying both
    the canonical sha and the terminal tag. (Helper events currently route
    to the root agent via `notify_manager` regardless of which agent
-   submitted the approval; routing them to the submitting agent is tracked
-   in #1953.)
+   submitted the approval; routing them to the submitting agent is a
+   known limitation under active development.)
 
 ### Withdrawing a pending approval
 
@@ -93,7 +93,8 @@ flow. On approve, hive-c0re seeds the proposed config repo with
 a default `agent.nix` template and sends `HelperEvent::ConfigReady { agent }`
 to the root agent's inbox (current limitation — all helper events route
 to the root agent via `notify_manager` regardless of which agent
-submitted; tracked in #1953). The submitting agent then reviews,
+submitted; routing to the submitting agent is under active development).
+The submitting agent then reviews,
 edits, and commits the template before calling `request_apply_commit`
 to proceed to an `ApplyCommit` approval. The first `ApplyCommit`
 creates the container; subsequent ones rebuild it with new config.
@@ -414,8 +415,9 @@ calls `bind_child_agent_dirs` for each entry in
 tool group can therefore edit, commit, and submit changes for any of
 its direct children directly inside its container at `/agents/<child>/config/`.
 
-Agents holding the `can_manage_top_level_agents` topology role get
-additional host-side bind mounts via `set_nspawn_flags`:
+Agents holding the `can_manage_top_level_agents` topology role
+(defined as `ROLE_CAN_MANAGE_TOP_LEVEL_AGENTS` in `hive-c0re/src/topology.rs`)
+get additional host-side bind mounts via `set_nspawn_flags`:
 
 - `/var/lib/hyperhive/agents/` → `/agents/` (RW) — all top-level
   agents' proposed repos (not just direct children).
@@ -550,7 +552,7 @@ message from sender `system` with the event JSON in the body. The
 root agent's harness no longer short-circuits these — they drive a
 regular claude turn so the root agent can react. (Today these go to the
 root agent regardless of which agent submitted the approval — routing to
-the submitting agent is tracked in #1953.) Variants
+the submitting agent is a known limitation under active development.) Variants
 (`hive_sh4re::HelperEvent`):
 
 - `ApprovalResolved { id, agent, commit_ref, status, note }` —