fix(approval-classes): approval evidence is the first non-blank line only, at column 0 (review #3235 r3)

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

docs/ship-policy.md

@@ -420,15 +420,14 @@ that resolves and binds:
 - A GitHub comment or review URL must be written by a `maintainers` login from
   the base's ship policy that equals the cited owner. A review must be in
   state `APPROVED`; a comment-only, dismissed or changes-requested review is
-  not an approval. Only approval lines count as evidence: a line the
-  maintainer wrote at top level that starts (after an optional list marker)
-  with `Approve` or `Approved`, any case, and names the token, or the class
-  and every effect path, such as
+  not an approval. The evidence is the body's first non-blank line only. It
+  must start at column 0 with `Approved` or `Approve` (any case, optionally
+  in `**` bold; no list marker, quote or indent) and name the token, or the
+  class and every effect path. Nothing later in the body counts, so a
+  rejection that quotes or nests an example approval approves nothing. For
+  example, a comment whose first line is
   `Approved data-repair@0123456789ab: preview-first, never at upgrade.`
-  Quoted and code text never counts: a blockquote (`>`), a fenced or indented
-  code block and an HTML comment are skipped, so a rejection that quotes an
-  example approval approves nothing, and neither does
-  `Do not approve data-repair@0123456789ab`.
+  verifies; one that opens with any other line does not.
 - A token is authoritative. Evidence that names the class with a different
   digest approved earlier effects: it does not bind, and it never falls back
   to matching the class and paths.