Summary

Fix the runtime so per-agent exec_policy = "allow" / mode = "full" actually bypasses the human approval gate for shell_exec.

Problem

LibreFang already supports lenient manifest parsing for per-agent exec_policy, but crates/librefang-runtime/src/tool_runner.rs still runs the approval gate before checking whether the effective exec policy is Full.

That means an agent manifest can explicitly allow full shell execution, and shell_exec still gets blocked by the approval flow first.

Why this is real

Current code path:

• approval gate runs near the top of execute_tool() for any tool with requires_approval(tool_name)
• is_full_exec is only computed later inside the shell_exec branch
• so the bypass never takes effect at the point where approval is decided

Scope

• compute whether the current call is shell_exec with exec_policy.mode == Full
• skip the approval gate in that case
• add tests proving approval is bypassed only for that case

Upstream reference: RightNow-AI/openfang#222