Consume Bot Social’s hold_reason instead of inferring a blanket hold from reasons #865

What is asked

Bot Social now returns a machine-readable hold_reason on an approval row (bot-social #51, merged as 461e04e2): risk | attachment | policy | blanket_outbound, strongest first. FlyBot still infers the same thing from reasons — plugins/social/src/social.js:122-132, holdIsBlanket — which is the fragile "exactly one reason, and it is the blanket marker" test #847 had to lean on.

Replace the inference with the field, and keep the old rule as the compatibility path for a server that does not send it yet.

Why it matters

• blanket_outbound is the only value the connector may clear by itself; every other value means a human decides. reasons cannot draw that line once a hold of another kind also reports blanket-shaped reasons.
• The face-room value face_room_auto_send_off (bot-social #53) is exactly that case: it is raised when the room's Auto-send switch is the only thing blocking a draftFaceRoomMessage send, and a DLP/risk finding on the same path still reports risk instead. A connector that clears it self-serves a bypass of the owner's switch.
• The predicate already has three callers (autoSendRemoteLine, autoSendRoomEnvelope, and the face Auto-send path). One predicate reading one field is what keeps them from drifting.

Scope

• plugins/social/src/social.js — the predicate (holdIsBlanket or its successor).
• Make sure the field survives the path that decides: the decision reads a list_approvals row, and the view in between (approvalView) must not drop hold_reason.
• docs/subsystems/social.md — the hold section names the field and the rule "only blanket_outbound is connector-decidable".
• Tests in plugins/social/test/social.test.js; one changelog.d/ fragment; Fixes #<this>.

Acceptance

1. Self-clear only when hold_reason === 'blanket_outbound'.
2. risk, attachment, policy, face_room_auto_send_off, and any value this build does not know keep their card and wait for the owner. face_room_auto_send_off must be treated exactly like risk/attachment/policy — there is no second allow-list for it.
3. A server that sends no hold_reason still gets today's rule: reasons exactly the blanket marker and no risk flags. New field absent must not turn into "not blanket" (that would strand every hold on an older server).
4. When the field and reasons disagree, the field wins: hold_reason: 'policy' with blanket-looking reasons keeps its card.
5. Negative controls: reverting to reasons-only reds case 4; treating a missing field as non-blanket reds case 3; allowing a non-blanket_outbound value reds case 2 — and that same control must red the face_room_auto_send_off case too, so the new value is pinned by a predicate, not by a name list.
6. One predicate. No call site may keep its own copy of "is this blanket".

Note

The face-room value's name is now fixed: face_room_auto_send_off (bot-social #53 @ da6b13cd, base 461e04e2). It appears only when the room Auto-send switch alone blocks the send — with a DLP finding the same path reports risk, and with auto_approve_face_rooms on there is no hold at all. Because the rule is "only blanket_outbound", the new value needs no code of its own: add it to the test table, keep it out of the self-clear branch.