fix(agent-core-v2): refuse, don't hang, when approval is needed unattended

[devGregA]

Problem — a regression from the hardening work, found by running the CLI

Excluding Bash from auto-mode approval (PR #5) left headless runs in a state nothing could resolve: kimi -p forces auto mode, the model calls Bash, the policy chain falls through to an ask — and a print-mode session has no UI to answer it. The process hangs forever.

This was not visible in the unit tests, because there the approval broker is absent and the fail-closed path (PR #2) returns a refusal. In a real session the broker is bound; it just never gets an answer.

Reproduced against a built CLI driven by a stub model endpoint: the run was still alive after 60s and had to be killed. Test suites were green throughout — this only shows up when the binary actually runs.

What changed

• An ask in auto mode now resolves as a refusal instead of going to the broker. Auto mode is documented as "fully autonomous, the agent will not ask questions", so the request cannot be answered by definition. This reuses the existing fail-closed branch rather than adding a second path, and the message names the tool and points at the [permission] allow rule so an unattended pipeline fails with something actionable. It mirrors auto-mode-ask-user-question-deny, which already solves exactly this for AskUserQuestion.
• FetchURL added to the auto-mode exclusion set. It was removed from the default approve set in PR chore(hardening): stop auto-approving Bash in auto mode and FetchURL by default #5, but auto mode still approved it, so headless runs could still send caller-chosen bytes to a caller-chosen host unprompted. Safe to close now that an unreachable ask fails fast instead of hanging.

Verified against the built CLI

Driven end-to-end through dist/main.mjs against a local stub model endpoint (no credentials), in an isolated KIMI_CODE_HOME:

probe	before	after
Bash in -p	hangs indefinitely	exits cleanly, refused with guidance
FetchURL in -p	executed unprompted	refused with guidance
Read of an ordinary file	works	works

Also confirmed unchanged in the same harness: symlink escape refused, .env refused, package.json write refused, and a [[permission.rules]] deny rule refusing the named tool.

Testing

• New unit test: in auto mode the broker is never called and the result is a veto mentioning "unattended".
• Full agent-core-v2 suite green: 310 files / 4906 tests.
• oxlint clean on changed files (one pre-existing warning elsewhere); tsc --noEmit clean.

Checklist

• Problem explained above.
• Tests added that prove the change works.
• Changeset added (patch).
• No doc update needed.