fix: use runtime tools for approval auto-approval

- load runtime tools dynamically from Copilot CLI capabilities via tools.list
- merge runtime tools with configured MCP and LSP tools in the approval catalog
- keep a fallback builtin runtime tool list when capabilities are unavailable
- move approval-tool pruning to the app service so dynamic tools are not dropped on load
- update approval UI and docs to use the corrected runtime-tool model

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

src/shared/contracts/sidecar.ts

@@ -1,6 +1,7 @@
 import type { PatternDefinition, PatternValidationIssue, ReasoningEffort } from '@shared/domain/pattern';
 import type { ApprovalCheckpointKind, ApprovalDecision } from '@shared/domain/approval';
 import type { ChatMessageRecord } from '@shared/domain/session';
+import type { RuntimeToolDefinition } from '@shared/domain/tooling';
 
 export interface SidecarModeCapability {
   available: boolean;
@@ -52,6 +53,7 @@ export interface SidecarCapabilities {
   runtime: 'dotnet-maf';
   modes: Record<PatternDefinition['mode'], SidecarModeCapability>;
   models: SidecarModelCapability[];
+  runtimeTools: RuntimeToolDefinition[];
   connection: SidecarConnectionDiagnostics;
 }