fix: use runtime tools for approval auto-approval

- load runtime tools dynamically from Copilot CLI capabilities via tools.list
- merge runtime tools with configured MCP and LSP tools in the approval catalog
- keep a fallback builtin runtime tool list when capabilities are unavailable
- move approval-tool pruning to the app service so dynamic tools are not dropped on load
- update approval UI and docs to use the corrected runtime-tool model

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

tests/shared/tooling.test.ts

@@ -157,7 +157,7 @@ describe('tooling settings helpers', () => {
     ).toBe('LSP profile "Typescript LSP" needs the "--stdio" argument.');
   });
 
-  test('lists approval tools from MCP and LSP definitions using runtime tool identifiers', () => {
+  test('lists builtin, MCP, and LSP approval tools using runtime tool identifiers', () => {
     const tools = listApprovalToolDefinitions({
       mcpServers: [
         {
@@ -195,6 +195,14 @@ describe('tooling settings helpers', () => {
       ],
     });
 
+    expect(tools).toContainEqual({
+      id: 'web_fetch',
+      label: 'web_fetch',
+      description: 'Fetch content from a URL.',
+      kind: 'builtin',
+      providerIds: ['builtin:web_fetch'],
+      providerNames: ['Built-in'],
+    });
     expect(tools).toContainEqual({
       id: 'git.status',
       label: 'git.status',
@@ -210,4 +218,27 @@ describe('tooling settings helpers', () => {
       providerNames: ['TypeScript'],
     });
   });
+
+  test('prefers dynamically reported runtime tools over the fallback builtin catalog', () => {
+    const tools = listApprovalToolDefinitions(
+      { mcpServers: [], lspProfiles: [] },
+      [
+        {
+          id: 'fetch',
+          label: 'fetch',
+          description: 'Dynamic runtime tool from Copilot CLI.',
+        },
+      ],
+    );
+
+    expect(tools).toContainEqual({
+      id: 'fetch',
+      label: 'fetch',
+      description: 'Dynamic runtime tool from Copilot CLI.',
+      kind: 'builtin',
+      providerIds: ['builtin:fetch'],
+      providerNames: ['Built-in'],
+    });
+    expect(tools.some((tool) => tool.id === 'web_fetch')).toBe(false);
+  });
 });