feat(permissions): enable auto mode classifier in Verboo Code

[savass33]

Summary

• Enable auto mode (the classifier-backed Shift+Tab permission mode) in Verboo Code, and rebrand its opt-in dialog / system notice.
• Why: auto mode was unreachable in this build. The GrowthBook kill switch defaults to disabled when the config is absent, and modelSupportsAutoMode() only allowlisted Anthropic model ids that never exist in the Verboo catalog. On top of that, the classifier prompts were stubbed to empty strings at build time, so the classifier had no policy to follow.

Impact

• user-facing impact: Shift+Tab now cycles default → acceptEdits → plan → auto. First entry still shows the opt-in dialog (consent preserved). Actions matching the deny policy (external code, irreversible destruction, persistence, security weakening, credential access, exfiltration, privilege escalation, prompt injection, obfuscation) are blocked; safe actions run without prompting.
• developer/maintainer impact: the build inlines the classifier prompts instead of stubbing them to ''. New Verboo-authored prompt files live under src/utils/permissions/yolo-classifier-prompts/.

Testing

• bun run build
• bun run smoke
• focused tests: bun test src/utils/permissions/ src/tools/BashTool/modeValidation.test.ts src/utils/fastMode.test.ts src/utils/effort.codex.test.ts src/utils/file.test.ts — 19 pass, 0 fail

Manual verification on the built dist/cli.mjs: gate tengu_auto_mode_config = { enabled: 'enabled' } present, modelSupportsAutoMode returns true in Verboo mode, classifier prompts are non-empty, and the carousel chain is default → acceptEdits → plan → auto.

Notes

• provider/model path tested: Verboo router (Anthropic-compatible, reported as firstParty). Source-mode carousel logic + built bundle.
• screenshots attached (if UI changed): opt-in dialog is now Verboo purple with "Verboo Code" wording (terminal output).
• follow-up work or known limitations:
  • The classifier runs on the main-loop model (tengu_auto_mode_config.model is unset). If a model cannot emit the classify_result tool call, the classifier fails closed (blocks) — safe default, but worth validating across catalog models.
  • The footer "Auto" mode indicator still uses the warning color (out of scope here).
  • BypassPermissionsModeDialog still shows [CC] and an Anthropic docs link (out of scope).
  • Upstream's classifier prompts are not mirrored in this repo; the added prompts are Verboo-authored and follow the documented deny categories.
  • Pre-existing (not introduced here): running from source with TRANSCRIPT_CLASSIFIER enabled hits an import cycle in classifierDecision.ts; verified it reproduces on a clean origin/main.