feat: enable 'always approve for session' for runtime tools

Runtime tool permission requests (read, write, shell, store_memory) now
resolve stable approval names via fallback in the sidecar approval
coordinator, enabling the 'Always approve' button and session-level
auto-approval for built-in tools.

Backend:
- Add fallback tool names for PermissionRequestRead (read),
  PermissionRequestWrite (write), PermissionRequestShell (shell),
  and PermissionRequestMemory (store_memory)
- Add autoApprovedToolName parameter to RequiresToolCallApproval
  for permission-kind-based session approval matching
- Track tool.execution_start events in ToolNamesByCallId for
  supplementary exact-name resolution

Frontend:
- Use approval.toolName ?? approval.permissionKind as fallback key
  in resolveSessionApproval and ApprovalBanner
- Add shell, read, write permission-kind entries to builtin approval
  tool definitions so pruning preserves session overrides

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

tests/shared/approval.test.ts

@@ -8,6 +8,7 @@ import {
   normalizePendingApproval,
   normalizePendingApprovalState,
   normalizeSessionApprovalSettings,
+  pruneSessionApprovalSettings,
   dequeuePendingApprovalState,
   enqueuePendingApprovalState,
   listPendingApprovals,
@@ -209,4 +210,34 @@ describe('approval helpers', () => {
       pendingApprovalQueue: undefined,
     });
   });
+
+  test('prune preserves permission-kind approval entries when they are known tools', () => {
+    const settings = normalizeSessionApprovalSettings({
+      autoApprovedToolNames: ['read', 'write', 'shell', 'git.status', 'unknown_tool'],
+    });
+    const knownToolNames = ['read', 'write', 'shell', 'git.status', 'bash', 'view'];
+
+    const pruned = pruneSessionApprovalSettings(settings, knownToolNames);
+    expect(pruned?.autoApprovedToolNames).toEqual(['read', 'write', 'shell', 'git.status']);
+  });
+
+  test('session approval with permission-kind entries overrides pattern defaults', () => {
+    const effective = resolveEffectiveApprovalPolicy(
+      {
+        rules: [{ kind: 'tool-call' }],
+        autoApprovedToolNames: ['git.status'],
+      },
+      normalizeSessionApprovalSettings({
+        autoApprovedToolNames: ['read', 'shell'],
+      }),
+    );
+
+    expect(effective).toEqual({
+      rules: [{ kind: 'tool-call' }],
+      autoApprovedToolNames: ['read', 'shell'],
+    });
+    expect(approvalPolicyRequiresToolCallApproval(effective, 'agent-1', 'read')).toBe(false);
+    expect(approvalPolicyRequiresToolCallApproval(effective, 'agent-1', 'shell')).toBe(false);
+    expect(approvalPolicyRequiresToolCallApproval(effective, 'agent-1', 'write')).toBe(true);
+  });
 });