Retire "Tier 1" language from user-facing output — everything is approval:*/rev:* vocabulary after design 009 nf-2gqu ← Beads

Twinned from https://github.com/cfsh/ninefold/issues/1055 by tools/beads/import_github.py's reconcile pass.

@aedanpope, on #1051 (2026-08-18), verbatim:

> also, the tool is printing "SUCCESS Tier 1 " but we should not be using Tier 1 language anymore, everything is approval scope , rev etc after design 009

Surfaced by the #1052 review as NOT-THIS-PR (the strings live outside that diff's file set). The user-facing occurrences today:

• tools/pr/perimeter_check.py:184 — "Tier 1 — inside the perimeter" (the check-run title Aedan quoted)
• tools/nflib/perimeter.py Ruling.render() — "T1: eligible" / "T1: not eligible — …"
• tools/nflib/authority.py Decision.render() — "TIER 1 (no human approval)"
• tools/pr/merge_pr.py (two sites) — "TIER 1, with no human approval" / "TIER 1 (no human approval)"

Design 009's vocabulary is approval:auto / approval:human (T4) and rev:* / risk:* (T3), so the renders should say something like approval:auto — inside the perimeter / needs approval:human — ….

Scope cautions for whoever takes it:

• Strings only, not the machine values, unless deliberately widened. Decision.authority == "tier1" and tier1_authority() are program surface with at least two consumers (merge_pr, perimeter_check); renaming them is safe only as one atomic PR across all callers, and is a separate decision from fixing what a human reads.
• Several tests assert on these render strings (test_nflib_perimeter, test_nflib_authority, test_perimeter_check, test_merge_pr) and go with them.
• Prose sweep: notes/merging.md, notes/reviewer.md and CLAUDE.md still explain the perimeter in "Tier 1" terms; the docs half is what makes the rename stick for the next session.
• Everything here is GOVERNANCE, so the PR waits for @aedanpope like any perimeter change.

Filed unclaimed.