Auto-run or named approval — the checklist automation that never forges a signature — step 7 of 8

Write run_checklist(items, today) — the router. One pass over the items, three buckets, printed as sections:

1. Not yet due (today - last_done < every) → bucket not due
2. Due with approval == "auto" → bucket auto-run
3. Due with a named approver → bucket approval needed, rendered as {task} -> {approver}

Print the sections in this order — auto-run:, approval needed:, not due: — each item on its own line indented two spaces, items in input order within each section.

Expected output:

auto-run:
  regenerate-low-stock-report
approval needed:
  forklift-inspection-log -> miguel
  post-300a-summary -> vera
not due:
  vendor-scorecards