Reduce fresh-session approval retries after live measurement

[Aaronontheweb]

Summary

• lock the sanitized 45-session post-swap measurement and its historical-grant limitation
• prefer structured file tools for known mutations and disposable text without adding executable-specific policy
• treat Tool access denied as terminal while preserving one explicit Tool execution deferred correction
• correct the natural-directory and disposable eval contracts

No approval authority, persistence, public API, or ShellSyntaxTree behavior changes.

Validation

• Release build: 0 warnings, 0 errors
• full tests: 7,522 passed; 15 expected skips
• focused guidance tests: 74 passed; 1 expected Windows skip
• strict OpenSpec, headers, Bash syntax, JSON, diff, changed-file formatting, and evidence PII contract pass
• Slopwatch: only the pre-existing PowerShellHostProbeTests timeout warning outside this diff

Fresh-session evals

• terminal trust-zone denial: 5/5, no scope substitution or retry
• disposable file output: 5/5
• known file edit: 4/5; the fifth ended before model behavior on provider 402

The reported grep pipeline complex prompt was located in a pre-swap subagent event. The swapped build already pins that exact sanitized shape as non-messy, so this PR adds no command-specific parser workaround.