Summary

• skip the approval gate for shell_exec when the effective agent exec_policy.mode is Full
• keep approval required for non-full exec policies
• add runtime tests covering both branches

Problem

LibreFang already deserializes per-agent exec_policy overrides correctly, but execute_tool() was still running the approval gate before it knew whether the effective policy was Full.

That meant agents configured with exec_policy = "allow" could still be blocked by the human approval flow before the shell-exec policy was considered.

Verification

• cargo fmt --all --check
• cargo check -p librefang-runtime
• cargo test -p librefang-runtime test_shell_exec_full_policy_skips_approval_gate
• cargo test -p librefang-runtime test_shell_exec_non_full_policy_still_requires_approval

Closes #22

Upstream reference: RightNow-AI/openfang#222