[hongkongkiwi]

What and why

Adds a per-task Auto-approve write requests toggle (issue #200).

The permission modes stop short of their promise: Accept edits only auto-approves file-edit
calls, so commands and other state-changing actions still interrupt, and the approval bar's
Approve all answers only the requests pending at that moment. The only escape was Full access,
which also drops sandbox limits. This adds a graduated option: when the toggle is on and the
task's permission mode is Standard or Accept edits, write-class permission requests are approved
automatically instead of prompting.

Scope, per harness:

• Claude family (Claude Code, GLM, MiMo): can_use_tool requests for Write, Edit, MultiEdit,
  NotebookEdit, Bash and TodoWrite are answered without prompting. Reads, questions, MCP tools
  and unknown tools keep asking; the allowlist is explicit so sensitive-path reads can never be
  waved through.
• Shared ACP path (opencode, Grok, DeepSeek, Command Code, Cline, Kilo, GitHub Copilot, Hermes,
  Antigravity): tool calls of kind edit, delete, execute and move are auto-answered, still
  requiring exactly one allow_once option and never answering structured questions. DeepSeek's
  edit-by-tool-name fallback is included.
• Codex: command-execution and file-change approvals are accepted in Standard mode only;
  permission escalations and the Approve for me reviewer are untouched.
• Devin, Muse, Pi/OMP, ZCode and Kimi keep their own approval policies and have no toggle.

The toggle never widens a restricted mode: Plan mode still declines writes, Approve for me keeps
reviewing, Full access is unchanged. Harness sandboxes are untouched (this removes prompts, not
guardrails). The flag is stored per task (sessions.auto_writes, schema 35, default off),
follows a task to its host computer (both task.configure and task.start carry it), is part
of the warm-process adoption key, and cannot be changed while a run is active, like mode
changes.

Known limitation: cloud-sandbox runs (Run on cloud) do not carry the toggle yet; the cloud task
row and the bridged remote session need their own plumbing. Connect mirrors are covered. Happy
to follow up with that as a separate change.

Also enables the previously unmatched tests/approval-modes.spec.ts in playwright.config.ts
(it targets the exact menu this change extends; its three existing tests pass).

How it was tested

• npm run build (typecheck + bundle)
• npm test (204/205; the one failure is a pre-existing date-format assertion in
  tests/tool-cards.test.mjs, present on main and untouched by this change)
• cargo test --locked --manifest-path src-tauri/Cargo.toml --lib (1731 passed, 74 ignored)
  and cargo clippy --all-targets -- -D warnings clean
• Relevant Playwright tests in Chrome (ui: 123 passed including the two stale menu-count
  tests reproduced failing before the fix; approval-modes, provider-settings, grok: 46 passed)
  and WebKit (ui: 52 passed, 1 skipped; approval-modes.spec is not in the WebKit config's
  testMatch)

The change was developed against a frozen failing-first suite (commit d58a169): the gating
matrix for all three harness paths plus storage schema tests were written and qualified failing
before the implementation, and stayed frozen through review. Three independent review passes
(two model reviewers plus a cross-provider second opinion) produced six findings, all fixed:
the two blockers were the remote task start dropping the flag end to end, and stale menu-count
assertions in tests/ui.spec.ts.

Checklist

• Commit messages follow <type>: <description>
• Docs in docs/ updated if behavior changed
• Preview mocks added in src/preview.ts for new IPC commands
• No telemetry, secrets or personal paths added

Fixes #200