feat: tool execution policies / allow once, always allow, "auto mode"

[Classic298]

auto mode inspired by Claude code - small task model decides based on task at hand if tool is safe to execute, strict system prompt for the task model, gets context from conversation, cache optimized for cheap task model cache hits