feat(approval): interactive approval workflow for supervised mode (#215)

- Add auto_approve / always_ask fields to AutonomyConfig
- New src/approval/ module: ApprovalManager with session-scoped allowlist,
  ApprovalRequest/Response types, audit logging, CLI interactive prompt
- Insert approval hook in agent_turn before tool execution
- Non-CLI channels auto-approve; CLI shows Y/N/A prompt
- Skip approval for read-only tools (file_read, memory_recall) by default
- 15 unit tests covering all approval logic

src/main.rs

@@ -38,6 +38,7 @@ use tracing::info;
 use tracing_subscriber::{fmt, EnvFilter};
 
 mod agent;
+mod approval;
 mod channels;
 mod rag {
     pub use zeroclaw::rag::*;