fix: remove redundant confirmation for configuration changes

Configuration apply previously required a separate native confirmation even in Agent Runtime Execute mode, and failed in clients without an approval callback. Use existing work-mode and tool authorization instead, preserving Ask read-only access and request-scoped plan validation. Update regression tests, tool descriptions and documentation.

Validation: 267 focused tests passed; typecheck and changed-file lint passed. Full tests timed out with failures in other modules; repository lint reported errors in unchanged files.

Release note: Execute 模式下通过 Agent Runtime 修改 GoodBuddy 配置不再额外弹出确认框，Ask 模式仍保持只读。

src/shared/goodbuddy-config-contracts.ts

@@ -415,7 +415,6 @@ export const goodbuddyConfigCapabilitiesOutputSchema = z
     version: z.literal(1),
     authorization: z.literal('request-scoped'),
     secretPolicy: z.literal('never-exposed-or-accepted'),
-    applyRequiresApproval: z.literal(true),
     operations: z.array(goodbuddyConfigOperationDescriptorSchema).length(10)
   })
   .strict()
@@ -428,7 +427,6 @@ export const goodbuddyConfigCapabilities = {
   version: 1,
   authorization: 'request-scoped',
   secretPolicy: 'never-exposed-or-accepted',
-  applyRequiresApproval: true,
   operations: goodbuddyConfigOperationDescriptors
 } as const satisfies GoodBuddyConfigCapabilitiesOutput
 
@@ -510,8 +508,7 @@ export const goodbuddyConfigPlanOutputSchema = z
       .min(1)
       .max(GOODBUDDY_CONFIG_MAX_OPERATIONS),
     overallRisk: goodbuddyConfigRiskSchema,
-    reload: goodbuddyConfigReloadSchema,
-    requiresApproval: z.literal(true)
+    reload: goodbuddyConfigReloadSchema
   })
   .strict()
   .superRefine((value, context) => {