fix(agent): disable automatic action approval gate

[RaresKeY]

Summary

Disables the temporary automatic agent-action approval gate so agent actions continue under the selected server-enforced sandbox boundary without per-action approval cards. The focused delta adds one explicit default-off switch, keeps the dormant behavior covered by opting it back in inside the legacy test module, and adds a regression for the production default. It does not weaken or bypass process sandboxing.

Stack

This PR sits after the container-ready foundation in #5815: #5817 → #6119 → #6118 → #6120 → #6121 → this PR → #5819 → #5821. Its unique delta remains the single commit b135b62378f10b94a7249b7a214c03a167ffbfd0, changing only the approval-gate switch and its focused regressions.

After #6119, #6118, #6120, and #6121 land, this branch should be restacked onto current dev before landing. #5819 and #5821 remain after this head. The recorded checks below describe the existing branch head and do not establish freshness after those foundations land.

Target branch

• This PR targets dev, not main. All PRs land in dev; main is curated by the maintainer at each release. If your PR is on main by accident, click "Edit" on this PR and change the base.

Linked Issue

Fixes #6083

Part of #5815

Depends on PR #6119, PR #6118, PR #6120, and PR #6121.

Type of Change

• Bug fix (non-breaking — fixes a confirmed issue)
• New feature (non-breaking — adds new behaviour)
• Breaking change (changes or removes existing behaviour)
• Refactor / cleanup (behaviour unchanged)
• Documentation only
• CI / tooling / configuration

Checklist

• I searched open issues and open PRs — this is not a duplicate. Make agent execution authority deterministic across untrusted context and privileged tools #5815 owns the broader execution-authority stack; the linked child issue owns this focused default-on gate behavior.
• This PR targets dev
• My changes are limited to the scope described above — no unrelated refactors or whitespace changes mixed in.
• I actually ran the app (docker compose up or uvicorn app:app) and verified the change works end-to-end. Type-checks and unit tests are not enough.
• I did not run the app/runtime validation and stated that gap in How to Test. Leave this unchecked when the app-run box above is checked.

How to Test

1. Run python -m pytest -q tests/test_agent_action_approval_gate_disabled.py tests/test_external_context_tool_gate.py tests/test_tool_approvals.py; the validated head reports 161 passing tests. The production-default regression allows sandboxed actions after external context, while the legacy suite explicitly re-enables and covers the dormant gate.
2. Run python -m py_compile src/tool_capabilities.py tests/test_agent_action_approval_gate_disabled.py tests/test_external_context_tool_gate.py.
3. Run git diff --check 87b93e657173d20e6b13079ee7063f9acc575edc...HEAD and verify git diff --stat 87b93e657173d20e6b13079ee7063f9acc575edc...HEAD contains only src/tool_capabilities.py plus the two focused test modules.
4. For optional live validation, start the app, perform a web-backed Agent step followed by a sandboxed Bash action, and confirm the action continues inside the selected sandbox without an automatic exact-action approval card.

Hosted validation on the exact public head reports 5,843 passed and 48 skipped. All substantive checks pass; the push-only Trivy SARIF upload is expectedly skipped.

Not run: live application flow, Docker/native runtime, or browser interaction.

Visual / UI changes — REQUIRED if you touched anything that renders

N/A — no rendered UI files are changed.

• Screenshot or short clip of the change in the running app, attached below. Mobile screenshot too if the change affects mobile.
• Style match: no UI styling changed.
• No new component patterns.
• I am not an LLM agent submitting a bulk PR. This is a focused, one-off, user-directed fix rather than an automated or mass submission.

Screenshots / clips

N/A — no rendered UI files changed.

[github-actions]

⚠️ PR description is complete; validation evidence is still outstanding

Changed-file classification: backend/runtime.

Author-reported runtime / visual state

• The author explicitly reports that app/runtime validation was not performed.

Checkboxes are author attestations. GitHub Actions results remain the execution evidence for CI; this check does not prove that a local command ran.

---

This comment updates automatically when the description or changed files change.