fix: remove redundant confirmation for configuration changes

Configuration apply previously required a separate native confirmation even in Agent Runtime Execute mode, and failed in clients without an approval callback. Use existing work-mode and tool authorization instead, preserving Ask read-only access and request-scoped plan validation. Update regression tests, tool descriptions and documentation.

Validation: 267 focused tests passed; typecheck and changed-file lint passed. Full tests timed out with failures in other modules; repository lint reported errors in unchanged files.

Release note: Execute 模式下通过 Agent Runtime 修改 GoodBuddy 配置不再额外弹出确认框，Ask 模式仍保持只读。

src/shared/goodbuddy-config-contracts.test.ts

@@ -200,7 +200,7 @@ describe('GoodBuddy configuration contracts', () => {
     ).toThrow()
   })
 
-  it('requires an expiring, approved plan and applies only its ID', () => {
+  it('requires an expiring plan without a standalone approval flag and applies only its ID', () => {
     const operation = goodbuddyConfigCommonExamples[0]!
     expect(
       goodbuddyConfigPlanOutputSchema.parse({
@@ -218,10 +218,10 @@ describe('GoodBuddy configuration contracts', () => {
           }
         ],
         overallRisk: 'low',
-        reload: 'none',
-        requiresApproval: true
-      }).requiresApproval
-    ).toBe(true)
+        reload: 'none'
+      })
+    ).not.toHaveProperty('requiresApproval')
+    expect(goodbuddyConfigCapabilities).not.toHaveProperty('applyRequiresApproval')
     expect(
       goodbuddyConfigApplyInputSchema.parse({
         planId: '00000000-0000-4000-8000-000000000002'

src/shared/goodbuddy-config-contracts.ts

@@ -415,7 +415,6 @@ export const goodbuddyConfigCapabilitiesOutputSchema = z
     version: z.literal(1),
     authorization: z.literal('request-scoped'),
     secretPolicy: z.literal('never-exposed-or-accepted'),
-    applyRequiresApproval: z.literal(true),
     operations: z.array(goodbuddyConfigOperationDescriptorSchema).length(10)
   })
   .strict()
@@ -428,7 +427,6 @@ export const goodbuddyConfigCapabilities = {
   version: 1,
   authorization: 'request-scoped',
   secretPolicy: 'never-exposed-or-accepted',
-  applyRequiresApproval: true,
   operations: goodbuddyConfigOperationDescriptors
 } as const satisfies GoodBuddyConfigCapabilitiesOutput
 
@@ -510,8 +508,7 @@ export const goodbuddyConfigPlanOutputSchema = z
       .min(1)
       .max(GOODBUDDY_CONFIG_MAX_OPERATIONS),
     overallRisk: goodbuddyConfigRiskSchema,
-    reload: goodbuddyConfigReloadSchema,
-    requiresApproval: z.literal(true)
+    reload: goodbuddyConfigReloadSchema
   })
   .strict()
   .superRefine((value, context) => {

src/shared/goodbuddy-config-tools.ts

@@ -53,10 +53,10 @@ export const goodbuddyConfigToolCatalog = {
   },
   apply: {
     name: 'goodbuddy_config_apply',
-    title: 'Apply an approved GoodBuddy configuration plan',
+    title: 'Apply a GoodBuddy configuration plan',
     description:
-      'Apply a previously planned request-scoped change after GoodBuddy approval controls authorize it. Raw operations and secrets are not accepted. If a later operation fails, the result reports partial application and the remaining operations are not attempted.',
-    summary: 'Apply one approved request-scoped configuration plan.',
+      'Apply a previously planned request-scoped change in Execute mode. The plan must be unexpired and can be applied only once. Raw operations and secrets are not accepted. If a later operation fails, the result reports partial application and the remaining operations are not attempted.',
+    summary: 'Apply one request-scoped configuration plan in Execute mode.',
     access: 'write',
     inputSchema: goodbuddyConfigApplyInputSchema,
     outputSchema: goodbuddyConfigApplyOutputSchema