✨ feat: add driver-scoped approvals

[zrr1999]

动机

当前工具授权只区分“无需授权”和“必须授权”，无法表达“手动对话需要确认，但由用户明确开启的 Goal / Repro / Loop driver 可以执行已界定的低风险动作”。这会让持续 driver 在创建 Draft PR 时反复阻塞；如果简单跳过授权，又会连带绕过 Ready PR、破坏性操作和任意执行等高风险边界。

解决方案

• 新增 manual_only 审批策略：手动 Session 走人工授权；只有仍存活的 Goal、Repro 或 plain Loop invocation 可以免授权执行该类动作。Workflow-only、停止、完成、替换和过期 invocation 均 fail closed，required 始终只能由人工批准。
• 将 Git Draft PR 首次提交纳入 manual_only；Ready/mixed PR、sync、cleanup、checkout/adopt/commit、任意命令执行和可写委派仍为 required。driver 的 Draft 权限绑定到 daemon 私有的精确 Artifact、canonical worktree、仓库/remote/config 与 invocation generation，并在外部写入前重新校验。
• 为 Goal/Repro 持久化受限外部写权限和 driver_local step authority；Repro 状态迁移到 v8，严格拒绝旧版本伪装的新 authority，同时保持 SessionView/Trace v1 的兼容投影。
• 收紧 driver 文件范围、Git/GitHub 子进程环境和 PR 状态检查，并同步英文/中文工具与自动化文档及回归测试。

说明

开启或恢复 driver 本身仍需要人工授权，避免手动模型自行提升权限。daemon SQLite 通过幂等迁移增加私有 target 状态；该 capability 不写入模型可编辑的 Artifact，也不暴露到协议投影。

[codspeed-hq]

Merging this PR will not alter performance

✅ 3 untouched benchmarks

---

_{Comparing codex/driver-low-risk-approval (485e0ed) with main (a78783e)¹}

Footnotes

1. No successful run was found on main (f542a90) during the generation of this report, so a78783e was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

[zrr1999]

Reviewer note (conflicts / overlap): this ready PR is mergeable_state=dirty against current main (12 files, including packages/spark-repro/src/index.ts vs the three-lane model that already landed). A correct resolve is a semantic rebase onto three-lane, not a textual union.

#408 already restores the same driver-scoped Draft/manual_only contract on current three-lane main. Treat #408 as the successor unless this branch is explicitly revived; do not merge both without reconciling.