Let supersede() reissue an expired approval given a fresh window

expired stays a terminal exit from valid (state machine unchanged),
but supersede() now also accepts it as a source status when the
caller supplies a validity window, linking a new successor approval
to the expired original instead of requiring a caller to mint an
unlinked replacement from scratch. Without a fresh window, an expired
source still conflicts exactly as before.

The original's status becomes superseded (not left as a bare dead-end
expired) and superseded_by points at the successor, so the link is
documented rather than hidden -- informed-decision's overview already
renders this automatically, no changes needed there.

Prompted by the operator missing infd-20260927-b01's approval window
during today's key-cape login outage (APPROVAL-WP-0003).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 169987@bnt-lap001
Assistant-Session: 322ef1ef-9048-4021-8570-b6d6f6347999

SCOPE.md

@@ -32,6 +32,12 @@ systems. Consumption follows the assented `GH-DEC-2026-003` contract.
 - The closed state machine
   `requested → approved → valid → consumed`, with
   `superseded / revoked / expired` as terminal exits from `valid`.
+  `expired` itself stays terminal -- it is never reopened in place -- but
+  `supersede` also accepts it as a source status when the caller supplies a
+  fresh `validity` window, linking a new, separately-approvable successor to
+  the expired original (whose own status becomes `superseded`, not left a
+  dead end) rather than requiring the caller to mint an unlinked replacement
+  from scratch.
 - Atomic supersession and single consumption (compare-and-swap, never
   read-then-write).
 - A PEP-called consume mutation before the protected side effect, with