docs: specify tiered API safety modes

[TeamNL1]

Summary

Adds a draft specification for three API safety modes: --default, --human, and --auto.

The specification preserves the existing safe default and defines a permanent create-only boundary for reduced-guardrail workflows: data may be read from Form A and written to a separate, non-colliding scope in Form B, but existing AMS data may never be updated, replaced, or deleted.

This PR contains descriptive guidelines only. It does not implement the modes or change runtime behavior.

Linked Issue

Relates to: no issue number has been assigned.

Relevant Aim IDs

B8, B9, C3, C5, C6, C7, C8, D1, D4, D5, D6, D7, D8, D9, D10, D11, D12, E4, E6, E7, E9, F6, F8

Highest applicable risk level: Critical.

Safety Impact

No credentials, AMS data access, writes, updates, upserts, deletes, sandbox guards, or production behavior are changed by this PR.

The specification proposes reduced approval interaction for reviewed workflows while retaining validation, dry-run planning, immutable previews, environment verification, scope limits, duplicate and retry protections, auditability, and credential safeguards.

The proposed --auto mode permanently prohibits updates, upserts, replacements, overwrites, archives, and deletes. Unattended live creation also remains disabled until the current governance conflict has been explicitly reviewed and resolved.

Testing

Commands run:

git diff --check