Resume always-ask tool confirmations

[yanpgwang]

Summary

• resume single built-in always_ask tool confirmations from the durable pending-action gate
• execute the original server-owned tool call on allow and emit its correlated agent.tool_result
• skip all execution on deny and deliver a correlated rejection result containing deny_message
• reject malformed/mismatched confirmations before any side effect
• preserve strict Messages role alternation when a parked response contained both text and tool use
• document multi-action, MCP, exact rejection wording, and crash-replay limitations without expanding scope

Verification

• go test ./...
• go test -race ./...
• go vet ./...
• confirmation runtime tests repeated 50 times
• confirmation allow/deny app tests repeated 20 times
• event-variant validation repeated 20 times
• npm run typecheck
• npm run build
• git diff --check