Tool gate

Confirm tool calls before they run.

Run with --no-yolo to confirm every tool call before it runs. A dialog shows the tool name and a one-line preview of its args with four choices: yes, yes-always-this-tool-this-session, yes-always-this-session, no.

The flag is interactive-TUI only. In -p, --json, and rpc modes it is ignored with a stderr warning and tools still run freely, so scripts and automation keep working.