[Feature] Add confirmation field to MCP server entries for tool execution gating

[MaryamZi]

There is currently no way for an agent author to declare that tools from a specific MCP server should require user approval before execution. Currently, human-in-the-loop confirmation has to rely on either:

1. The LLM remembering to ask in chat text (unreliable, fragile)
2. MCP tool annotations like destructiveHint (most MCP servers don't set these)

Agent authors would generally want to decide when confirmation is required (vs the MCP author) -- therefore, it makes sense for it to be reflected in the AFM file.

One option is to add an optional confirmation field to MCP server entries in the AFM tools.mcp section:

tools:
  mcp:
    - name: "github"
      transport:
        type: "http"
        url: "https://api.githubcopilot.com/mcp/"
        authentication:
          type: "bearer"
          token: "${env:GITHUB_TOKEN}"
      tool_filter:
        allow:
          - "pull_request_read"
          - "get_file_contents"
          - "pull_request_review_write"
      confirmation: required                                                                                                                                                                                                                                                  

Valid values:

• required — the interpreter MUST prompt the user (or equivalent gating mechanism) before executing any tool from this server
• auto (default) — execute without prompting

Semantics

• The field is optional. Omitting it is equivalent to auto.
• The field applies at the server level — all tools from a server with confirmation: required are gated. Per-tool granularity could be a future extension but server-level covers the primary use case (e.g., shell servers, deployment servers). Multiple tool blocks for the same MCP server with different tools and confirmation values could be a workaround for now.
• How confirmation is presented is up to the interpreter/tool (CLI prompt, dialog box, etc.). The spec only requires that execution is blocked until approval is granted.