refactor: unify tool approval into a single engine and cut prompt storms

Collapse the dual permission stack into one policy. The runtime-side
ToolPermissionResolver (own safe lists, own grant memory, bypassed the
ApprovalEngine whenever it said ALLOW) is deleted; runtime_v2 now consults
ApprovalEngine.predict(), a synchronous fast path reading the same config
and the same persisted allowlist as the async authorize pipeline, so a
grant given anywhere is honored everywhere. permissions.py keeps only a
policy-free adapter; the duplicated permissions_v2 config fields and the
runtime grant persistence loop are removed (stale YAML keys are ignored).

New shell_safety module becomes the single source of truth for shell
classification: flag-audited read-only commands (awk/od/jq/sed -n/diff/
git subcommand table/... auto-allow; find -delete, sort -o, curl -o/-d,
rg --pre still prompt even when the bare name is config-listed),
keyword-aware compound splitting (loop/branch headers no longer poison
grants), expansion-safe $() handling, and fail-closed treatment of
anything unparseable or substitution-bearing.

Grant semantics are rebuilt around derived word-boundary prefixes:
"python3 -c" instead of token bags, interpreter -c/-m kept in the prefix,
bash/eval/sudo never grantable as prefixes, read-only segments exempt
from the every-candidate-must-match rule so a granted command chained
with ls/echo verification passes, and approve-once now records the exact
candidates as a session grant so identical re-runs stop re-prompting.
The authorize heuristic also audits the original command text instead of
the quote-dropping preview (echo "<EOF>" no longer reads as redirection).

Validated live on zz_perm_probe1 (native minimal org): awk/od/ls/cat/
sha256sum ran with zero cards, python3 -c parked once and three different
python3 -c commands then passed via the persisted prefix grant, and an
agent-issued rm -f compound correctly re-prompted showing only the
segments needing approval. Full suite failures are byte-identical to the
pre-change HEAD baseline (27 pre-existing).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

opc/layer3_agent/native_agent.py

@@ -284,6 +284,7 @@ class NativeAgent:
         config: OPCConfig | None = None,
         communication: Any | None = None,
         approval_callback: Any = None,
+        permission_policy: Any = None,
     ) -> None:
         self.role = role
         self.llm = llm
@@ -297,6 +298,7 @@ class NativeAgent:
         self.config = config or OPCConfig()
         self.communication = communication
         self.approval_callback = approval_callback
+        self.permission_policy = permission_policy
         self.prompt_profiles = PromptProfileManager(role, self.config)
         max_iter = self.config.system.max_agent_iterations
         comp_threshold = self.config.system.context_compression_threshold
@@ -312,6 +314,7 @@ class NativeAgent:
             config=self.config,
             child_agent_factory=self._create_child_agent,
             approval_callback=approval_callback,
+            permission_policy=permission_policy,
             prefetch_provider=self._build_runtime_prefetch_payload,
         )
 
@@ -741,4 +744,5 @@ class NativeAgent:
             config=child_config,
             communication=self.communication,
             approval_callback=self.approval_callback,
+            permission_policy=self.permission_policy,
         )