feat: cache same-turn approval selections

Add an AlwaysApprove flag to resolve-approval commands and cache
approved tool keys for the current request so repeated runtime
permissions are auto-approved immediately within the same turn.
The cache is cleared when the turn finishes to avoid leaking across
future requests.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

sidecar/tests/Aryx.AgentHost.Tests/SidecarProtocolHostTests.cs

@@ -643,6 +643,7 @@ public sealed class SidecarProtocolHostTests
                 RequestId = "approval-command-1",
                 ApprovalId = "approval-1",
                 Decision = "approved",
+                AlwaysApprove = true,
             },
             host);
 
@@ -651,6 +652,7 @@ public sealed class SidecarProtocolHostTests
         Assert.Equal("approval-command-1", completionEvent.GetProperty("requestId").GetString());
         Assert.Equal("approval-1", captured?.ApprovalId);
         Assert.Equal("approved", captured?.Decision);
+        Assert.True(captured?.AlwaysApprove ?? false);
     }
 
     [Fact]