Add PermissionRequest hook for tool approvals / 新增工具审批 PermissionRequest Hook

[SivanCola]

Summary

Fixes #3661.
Related: #3855.

This PR keeps the scope limited to the PermissionRequest hook from #3855. The separate move_file work remains in #4316 and is intentionally outside this PR.

Authorship note

@AresNing is the primary author of the PermissionRequest hook implementation originally proposed in #3855. @SivanCola contributed as a collaborator by rebasing it onto the current main-v2, resolving integration conflicts, adding explicit regression coverage for prompt-triggered and non-triggering paths, and verifying the scoped PermissionRequest state.

What changed

• Add PermissionRequest to the hook event list, default timeout handling, tool-name matching, hook payload, runner, CLI hook view, and example config.
• Fire PermissionRequest only when a real tool approval prompt is emitted; policy allow, session grants, auto/yolo approval, and plan approval do not trigger it.
• Add regression coverage for hook matching, payload delivery, prompt-only triggering, non-triggering paths, and CLI hook rendering.

Validation

• go test ./internal/boot ./internal/cli ./internal/control ./internal/hook
• go test ./...
• git diff --check origin/main-v2..HEAD

[SivanCola]

@codex review

[SivanCola]

approve

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e542da6388

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Redact memory approval payloads before hooks

When the pending approval is for remember/forget, gateApprover.Approve reaches this line with the original JSON args and a memory-derived subject; remember args include the private body field, while the memory approval contract says external notification hooks receive only the tool name (docs/SESSION_MEMORY_RETRIEVAL.md). Because this guard only excludes plan approvals, a user/project PermissionRequest hook configured for notifications can receive private memory content before the user approves it; please skip these fresh memory approvals here or pass a redacted payload.

Useful? React with 👍 / 👎.