feat(tui): enforce durable execution-mode workflows

[ZhiXiao-Lin]

Summary

• bind Default, Plan, and Auto execution policy to the admitted or queued turn, including rebuilt Core sessions
• make Auto fully non-interactive for allowed operations while preserving hard policy and workspace denials
• make Plan strictly read-only and stop at an explicit Approve, Revise, or Abandon review boundary; approved implementation starts as a new Default turn
• add Ctrl+O Send now without cancelling a durable goal, and distinguish active versus next mode in the footer
• update TUI help, README, changelog, and focused regression coverage

Validation

• cargo fmt --all -- --check
• cargo check --bin a3s
• execution-policy and Auto permission/confirmation tests
• Plan Review Approve/Revise/Abandon tests
• queued-mode, Send-now, slash-command, and confirmation-manager inheritance tests
• real Auto shell side-effect integration test with zero confirmation events
• HITL confirmation-wait timeout isolation test

Recovery scope

This is the focused extraction of a preserved interrupted development session. It intentionally excludes the independent session fork/rebind, relay, Agent Island, and permission-grant work so those can be reviewed separately.

[ZhiXiao-Lin]

Integrated through #40 at merge commit c252583e413f70a4cb265012d776f9d050b94de5. The consolidated v0.9.7 branch contains this PR's latest head ec385aa0a575846a52624bee3a63f6ad00f8eb60 and passed Linux, macOS, and Windows CI.