fix: remove redundant confirmation for configuration changes

Configuration apply previously required a separate native confirmation even in Agent Runtime Execute mode, and failed in clients without an approval callback. Use existing work-mode and tool authorization instead, preserving Ask read-only access and request-scoped plan validation. Update regression tests, tool descriptions and documentation.

Validation: 267 focused tests passed; typecheck and changed-file lint passed. Full tests timed out with failures in other modules; repository lint reported errors in unchanged files.

Release note: Execute 模式下通过 Agent Runtime 修改 GoodBuddy 配置不再额外弹出确认框，Ask 模式仍保持只读。

src/shared/goodbuddy-config-tools.ts

@@ -53,10 +53,10 @@ export const goodbuddyConfigToolCatalog = {
   },
   apply: {
     name: 'goodbuddy_config_apply',
-    title: 'Apply an approved GoodBuddy configuration plan',
+    title: 'Apply a GoodBuddy configuration plan',
     description:
-      'Apply a previously planned request-scoped change after GoodBuddy approval controls authorize it. Raw operations and secrets are not accepted. If a later operation fails, the result reports partial application and the remaining operations are not attempted.',
-    summary: 'Apply one approved request-scoped configuration plan.',
+      'Apply a previously planned request-scoped change in Execute mode. The plan must be unexpired and can be applied only once. Raw operations and secrets are not accepted. If a later operation fails, the result reports partial application and the remaining operations are not attempted.',
+    summary: 'Apply one request-scoped configuration plan in Execute mode.',
     access: 'write',
     inputSchema: goodbuddyConfigApplyInputSchema,
     outputSchema: goodbuddyConfigApplyOutputSchema