fix: remove redundant confirmation for configuration changes

Configuration apply previously required a separate native confirmation even in Agent Runtime Execute mode, and failed in clients without an approval callback. Use existing work-mode and tool authorization instead, preserving Ask read-only access and request-scoped plan validation. Update regression tests, tool descriptions and documentation.

Validation: 267 focused tests passed; typecheck and changed-file lint passed. Full tests timed out with failures in other modules; repository lint reported errors in unchanged files.

Release note: Execute 模式下通过 Agent Runtime 修改 GoodBuddy 配置不再额外弹出确认框，Ask 模式仍保持只读。

src/shared/goodbuddy-config-contracts.test.ts

@@ -200,7 +200,7 @@ describe('GoodBuddy configuration contracts', () => {
     ).toThrow()
   })
 
-  it('requires an expiring, approved plan and applies only its ID', () => {
+  it('requires an expiring plan without a standalone approval flag and applies only its ID', () => {
     const operation = goodbuddyConfigCommonExamples[0]!
     expect(
       goodbuddyConfigPlanOutputSchema.parse({
@@ -218,10 +218,10 @@ describe('GoodBuddy configuration contracts', () => {
           }
         ],
         overallRisk: 'low',
-        reload: 'none',
-        requiresApproval: true
-      }).requiresApproval
-    ).toBe(true)
+        reload: 'none'
+      })
+    ).not.toHaveProperty('requiresApproval')
+    expect(goodbuddyConfigCapabilities).not.toHaveProperty('applyRequiresApproval')
     expect(
       goodbuddyConfigApplyInputSchema.parse({
         planId: '00000000-0000-4000-8000-000000000002'