feat: category-based approval for runtime tools

Replace 20+ individual runtime tool toggles with 5 permission categories
(read, write, shell, web_fetch, store_memory) matching how Copilot CLI,
Cline, and other coding agents handle approvals.

- Add resolveApprovalToolKey() to map permission kinds to category IDs
- Simplify fallbackRuntimeApprovalTools to 5 categories
- Thread alwaysApprove through PendingApprovalHandle → sidecar resolve
- Update ApprovalBanner to use category labels for Always Approve button
- Update ResolveApprovalCommand contract with alwaysApprove field
- Update tests for category-based model

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

tests/shared/approval.test.ts

@@ -9,6 +9,7 @@ import {
   normalizePendingApprovalState,
   normalizeSessionApprovalSettings,
   pruneSessionApprovalSettings,
+  resolveApprovalToolKey,
   dequeuePendingApprovalState,
   enqueuePendingApprovalState,
   listPendingApprovals,
@@ -240,4 +241,24 @@ describe('approval helpers', () => {
     expect(approvalPolicyRequiresToolCallApproval(effective, 'agent-1', 'shell')).toBe(false);
     expect(approvalPolicyRequiresToolCallApproval(effective, 'agent-1', 'write')).toBe(true);
   });
+
+  test('resolveApprovalToolKey returns permission category for runtime tools', () => {
+    expect(resolveApprovalToolKey('view', 'read')).toBe('read');
+    expect(resolveApprovalToolKey('edit', 'write')).toBe('write');
+    expect(resolveApprovalToolKey('bash', 'shell')).toBe('shell');
+    expect(resolveApprovalToolKey('web_fetch', 'url')).toBe('web_fetch');
+    expect(resolveApprovalToolKey('store_memory', 'memory')).toBe('store_memory');
+  });
+
+  test('resolveApprovalToolKey returns tool name for non-runtime tools', () => {
+    expect(resolveApprovalToolKey('git.status', 'mcp')).toBe('git.status');
+    expect(resolveApprovalToolKey('lsp_ts_hover', 'custom-tool')).toBe('lsp_ts_hover');
+    expect(resolveApprovalToolKey('web_fetch', 'hook')).toBe('web_fetch');
+    expect(resolveApprovalToolKey('some_tool', undefined)).toBe('some_tool');
+  });
+
+  test('resolveApprovalToolKey returns undefined when both are absent', () => {
+    expect(resolveApprovalToolKey(undefined, undefined)).toBeUndefined();
+    expect(resolveApprovalToolKey(undefined, 'mcp')).toBeUndefined();
+  });
 });