feat(sandbox): replace hard denies with permission-gated RequiresApproval

[yishuiliunian]

Summary

• Sandbox path violations (writes outside cwd, deny_write_globs, deny_read_globs) now flow through the permission system instead of hard-blocking. Bypass auto-allows, Supervised asks the user, Auto asks the classifier.
• PathDecision simplified from four variants (Allow/DenyWrite/DenyRead/RequiresApproval) to clean three-state model: Allow / Deny / RequiresApproval.
• Session-scoped approval caching via ApprovedPaths ensures each path is only prompted once per session.

Changes

Layer	Files	What
Types	loopal-config/sandbox.rs, loopal-error/io_error.rs	PathDecision::Deny + RequiresApproval, ToolIoError::RequiresApproval
Sandbox	loopal-sandbox/path_checker.rs	deny globs + outside-cwd → RequiresApproval; ReadOnly stays Deny
Backend trait	loopal-tool-api/backend.rs	approve_path() + check_sandbox_path()
Backend impl	loopal-backend/approved.rs (new), platform.rs (new), local.rs, path.rs	ApprovedPaths with RwLock<HashSet>, resolve_checked fallback
Runtime	sandbox_precheck.rs (new), tools_check.rs	Path extraction + pre-check, permission elevation to Dangerous
Tests	8 new test files, 35 new tests	backend, sandbox, runtime layers

Test plan

• bazel test //... — 50 tests pass
• bazel build //... --config=clippy — zero warnings
• bazel build //... --config=rustfmt — clean
• CI passes