[HOLD-for-9.0.0][skip-runtime-e2e] docs(decisions): canonical /decisions verdict values

[saurabhjain1592]

⛔ HELD — do NOT merge until the 9.0.0 release ships

Pre-release docs/example refresh for 9.0.0. The /api/v1/decisions read surface canonicalized on the platform (merged on axonflow-enterprise main, not yet released): the endpoint returns allowed|blocked|redacted|needs_approval|error and the ?decision= filter rejects the old allow|deny|require_approval with HTTP 400. This PR merges at the 9.0.0 cut alongside the held migration guide. Ready-for-review so it can be approved now.

Tracking: getaxonflow/axonflow-enterprise#2669 (follow-up to the #2668 SDK sweep). Migration guide: getaxonflow/axonflow-docs#554.

What this changes (docs / examples / fixtures only — no logic or type change)

• axonflow/decisions.py — DecisionExplanation.decision, DecisionSummary.decision field comments + the ListDecisionsOptions.decision filter docstring → canonical set, with a pointer to the v8→v9 migration guide.
• examples/list_decisions.py — the AXONFLOW_LIST_DECISION env-var doc → canonical values (notes the old values now 400).
• tests/test_decisions.py — decision-verdict fixtures/asserts and the filter-serialization mock URLs → canonical, kept in sync and green.

Explicitly NOT touched (different, unchanged surfaces)

• The wire /api/v1/decide verdict (allow|deny|needs_approval) and the pre-check response decision field — frozen PEP enforcement contract.
• The workflow-control / WCP gate decision (allow|block|require_approval in workflow.py / execution.py, e.g. PendingApproval.decision in test_wcp_approvals.py) — a separate surface, not the audit read; left as-is.
• ExplainPolicy.action (policy-action vocab) and reason strings.

Validation

• Full unit suite green: 1039 passed, 29 skipped, coverage 82% (gate 75%).
• Repo grep is clean of stale /decisions verdict values (only the intentional migration-reference text remains).
• DCO signed; conventional title; no AI attribution.

Skip-runtime-e2e justification

Docs / examples / test-fixtures only — no runtime behavior or wire change. The SDK forwards the /decisions ?decision= filter string verbatim (no client-side validation), so there is nothing new to exercise against a live stack: this updates docstrings, the list_decisions example env-var doc, and test fixtures from the pre-9.0.0 allow|deny|require_approval vocabulary to the canonical allowed|blocked|redacted|needs_approval|error. Fully covered by the in-repo unit/contract tests (all green locally). Held for the 9.0.0 release.