[Bots] Verified bots: docs state no review time and no applicant-visible status

### Existing documentation URL(s)

- https://developers.cloudflare.com/bots/concepts/bot/verified-bots/
- https://developers.cloudflare.com/bots/reference/bot-verification/web-bot-auth/

### What changes are you suggesting?

The Verified bots page describes the Bot Submission Form and says an approved bot appears in Radar's bots and agents directory. It does not state how long review takes, and it gives an applicant no way to see where a submission stands. The Radar directory is a yes/no signal that only changes at the very end, so an applicant whose entry is absent cannot distinguish a queue from a rejection from a lost record.

Two additions would close the gap:

1. State the expected review time for each validation method, even as a range.
2. Document what an applicant should check while waiting, and what each outcome means.

Point 2 needs one clarification in particular, because the two available signals can disagree. A signed request to `https://crawltest.com/cdn-cgi/web-bot-auth` returning 401 `unknown public key or unknown verified bot ID for keyid` is currently the only live feedback an applicant using the Request Signature method gets, and it is not documented as a status check. A Community thread from 2026-08-27 reports BuiltWith listed as Verified at https://radar.cloudflare.com/bots/directory/builtwith, with its Signature Agent URL set to the directory it serves, while its signed requests still return that same 401. The docs should say which of the two signals is authoritative for approval status, and what a 401 means for a bot that is already listed.

### Additional information

This is a recurring question rather than one person's confusion. A search of the Community forum returns 22 threads about Verified Bots submissions; 4 have any reply at all, and every thread created since 2026-08-03 has none. Titles include "Verified Bot submission (Web Bot Auth) stalled since 2026-06-16", "Verified Bot submission via Web Bot Auth still pending after 30 days", "Verified Bots application stuck since July", and "Verified Bot (Web Bot Auth) submission pending activation".

Concrete case, for context on what an applicant can and cannot see. DealerHandshakeBot/1.0, operated by Dealer Handshake Inc., disclosure page https://dealerhandshake.com/bot/, verification method Request Signature, category Search Engine Optimization. Key directory: https://api.platform.dealerhandshake.com/.well-known/http-message-signatures-directory, serving `Content-Type: application/http-message-signatures-directory+json`, with the directory response itself signed, Ed25519, keyid `krGqEyWWler0OGGfK9uqcuXAhHSY3YNcsnB2s1kn-7I` (RFC 7638 thumbprint of the published JWK).

A re-submission through the dashboard form on 2026-08-19 was rejected with "bot with this signature agent URL already exists", which indicates the record is registered against that directory URL. Twenty days later, on 2026-09-08:

- `https://radar.cloudflare.com/bots/directory/dealerhandshakebot` returns 404
- a signed GET to `https://crawltest.com/cdn-cgi/web-bot-auth` returns 401 `unknown public key or unknown verified bot ID for keyid` (cf-ray `a379cb69dfd81220`)

Those two agree here, which is the expected case. The BuiltWith thread above is the case where they do not, and that is the one the docs currently leave undefined.