Fix headless reviewed-safe authority

[Aaronontheweb]

What this fixes

Headless runs, reminders, and webhooks cannot ask a user for approval. The reviewed-safe command catalog was nevertheless able to cover an otherwise-unapproved shell candidate in those runs.

This change limits reviewed-safe phrase coverage to runs that can actually ask for approval. Unattended runs still accept explicit one-time, session, folder, and global grants. Approval-exempt side effects keep their existing bounded behavior.

Why this is bounded

• No command-specific parsing
• No change to the original tool call or execution history
• No public API change
• No change to interactive reviewed-safe behavior
• No change to hard-deny, protected-path, or persistent-store failure handling

Regression coverage

• Interactive reviewed-safe candidate still allows
• Unattended reviewed-safe candidate stays uncovered without authority
• Explicit persistent grant still covers an unattended candidate
• A partial grant cannot use reviewed-safe policy to fill an unattended coverage gap

Validation

• Focused policy tests: 317 passed
• Full Actors suite: 3,170 passed, 1 expected Windows-only skip; one unrelated reminder test flaked once and passed 3/3 on exact rerun
• Release solution build: 0 warnings, 0 errors
• Strict OpenSpec validation
• Header verification
• Format verification
• Changed-file Slopwatch: 0 findings
• Adversarial review: PASS