feat: K-brain AI approval settings and risk display

[xiaozhou26]

Closes #966

Summary

• Add Off / Risk warnings only / Automatic approval and reviewer model selection to Settings → System tools.
• Persist through K-brain; display review notifications and risk descriptions in manual approval requests.
• Fail closed when legacy WebUI transport cannot respond to manual approval.
• Backend release lock will be updated to K-brain beta.7 before shipping LiveAgent beta.12.

Screenshots / preview

Verification

• GUI: 3055 passed, 1 skipped; WebUI: 771 passed.
• Gateway go test -race ./internal/kbrain passed.
• GUI/UI/WebUI typechecks and UI boundary checks passed.
• Chrome in both Vite hosts at 1280/390px: modes, persistence, reload, failed save recovery and no horizontal overflow.
• docs/verification/ai-approval/README.md documents evidence and limitations; no real cloud-model accuracy or installed Tauri package claims.

Release target: v2.0.0-beta.12.

[xiaozhou26]

K-brain PR #28 merged and v0.107.6-beta.7 published. Release lock now pins a184bbc12981381e969505a951dbb14e98c1d342 and verified checksums for all four LiveAgent targets (backend + computer helper). All 12 K-brain release binaries matched SHA256SUMS. Production GUI and WebUI builds passed locally. Original PR CI succeeded; waiting for checks on the updated release lock before merging/tagging beta.12.

[xiaozhou26]

Release preparation verified all four locked targets (macOS arm64/x64, Linux x64, Windows x64), including backend/helper hashes and packaging receipts. Actual released K-brain beta.7 passed mode persistence and full local HTTP reviewer/tool/manual-confirmation smoke tests. Stable Latest remains K-brain v0.107.5 / LiveAgent v1.3.7.

[xiaozhou26]

Published: https://github.com/Stack-Cairn/LiveAgent/releases/tag/v2.0.0-beta.12 . Desktop release workflow succeeded on macOS arm64/x64, Windows x64 and Linux x64. All 8 published package assets match downloaded CI artifact sizes/digests. macOS bundle version and stripped backend/helper payloads match K-brain beta.7; Windows portable and Linux deb backend/helper SHA256 match the lock. latest.json exists, targets beta.12, references uploaded Windows/Linux assets with matching nonempty signatures. macOS previews remain unsigned and use manual download. Stable Latest unchanged (LA v1.3.7, KB v0.107.5).