docs: Risk Acceptances 2.0, and the risk-acceptance parts of Rules Engine 2.0

[devGregA]

Documentation for Risk Acceptances 2.0, the Pro exception-management lifecycle, plus the risk-acceptance parts of the Rules Engine 2.0 reference.

Docs only — no code changes.

What is documented

triage_findings/findings_workflows/PRO__risk_acceptance.md gains a Risk Acceptances 2.0 section covering:

• The lifecycle — proposed, under review, approved, rejected, active, expired, and which moves are legal from each. Risk Acceptances created before the feature read as active, which is what they are.
• Who can do what — requesting an exception and deciding one are separate permissions, so the person who asks is not automatically the person who agrees. Includes the rule that the requester cannot be their own approver, and the system setting that relaxes it.
• Extending an expired acceptance — an expiration date exists because somebody wanted the risk looked at again, so by default extending one goes back through review. Explains the 409, that the older reinstate route refuses for the same reason rather than being a way around it, and the setting that turns the requirement off.
• A read-only auditor — how to build the persona with a custom role holding only Risk Acceptance View, what it can read, and why no built-in role changes.
• Requested exceptions in your metrics — why a Finding awaiting a decision stays active and counted, and how it is told apart from work nobody has looked at.
• The record of what was accepted — the durable acceptance history that survives expiry and reimport.
• Standing acceptances — matching criteria, and that matching stops when the acceptance stops being active.
• The review thread — decisions and comments as one time-ordered conversation.
• Notifications and webhooks — which events fire, who they go to, and the webhook payload carrying the state change itself rather than a sentence to parse.
• Reports — the approval chain columns, and why they are empty for acceptances made before the workflow existed.
• Backlog metrics — what each number means, including the distinction between overdue (past its date and still suppressing Findings) and expired.
• API — the state and transition endpoints, the request-an-exception endpoint, and the acceptance-history endpoint.

automation/rules_engine_2/building_rules.md and node_reference.md gain the risk-acceptance parts of the rules engine: the acceptance condition paths, and the Accept Risk action's severity limit — including what happens to a Finding over that limit, and that the condition fields read empty when the feature is off so a rule matches nothing rather than acting on a lifecycle the install does not use.

Notes for review

• Every behaviour described here is either already in the open-source code or is Pro behaviour reached through the documented API; the docs tree covers both, as it does today for other Pro features.
• Sections state the flag-off behaviour wherever it differs, since the feature ships default-off.
• No screenshots — the pages describe behaviour in words.