feat(safety): add restricted mode for unattended runs

[Sayt-0]

Summary

• add a canonical restricted safety mode for unattended and headless runs
• allow classifier-safe and explicitly allow-listed calls while denying unmatched destructive or unknown calls without prompting
• preserve the existing deny > allow > ask rule precedence and expose mode_restricted in approval audit events
• support the mode across CLI, YAML defaults, aliases, user settings, sessions, API validation, schema, examples, and documentation

Issue expectations

Issue expectation	Implementation
Run unattended without human confirmation	restricted resolves its fallback to allow or deny without prompting
Reuse built-in safety patterns	calls classified safe are auto-approved
Allow selected custom operations	existing permissions.allow rules run before the mode fallback
Deny everything else	unmatched destructive and unknown calls are denied
Preserve explicit safeguards	deny rules remain dominant; session-scoped ask rules and preempting hooks still gate

Safety matrix

Mode	safe	destructive	unknown
restricted	allow	deny	deny

restricted is defense in depth rather than an isolation boundary. Sandboxing remains recommended for untrusted unattended workloads.

Validation

• go test ./...
• ./scripts/build.sh
• golangci-lint run
• go run ./lint .
• go mod tidy --diff
• hugo build --quiet
• git diff --check

Closes #3967