emrg: remove Ask/Auto mode — session sandbox three-tier switcher

[argszero]

Remove the Ask/Auto working-mode dimension and replace it with a per-session sandbox three-tier switcher, per host rant 2026-08-20T18:18 (two orthogonal dimensions were too complex).

Before: Ask (pure chat, no tools) / Auto (run tools) in the GUI composer + task-level sandbox tiers.
After: no Ask/Auto — every message allows tools; a session-level sandbox tier (read-only / workspace-write / danger-full-access, default workspace-write) controls the bash tool's file permissions.

Changes:

• daemon.py: allow_tools always True (mode=ask empty-tool-set branch removed); ask_injected kept for signature compatibility (always False)
• GUI index.html + app.js: mode-switcher (Ask/Auto buttons) → sandbox-switcher (three-tier segmented control); state.mode → state.sandbox; setMode → setSandbox (whitelist read-only/workspace-write/danger-full-access); sendMessage + queuedSends carry sandbox
• main.js + daemon_client.js: sandbox passthrough on every task message (default workspace-write)
• i18n: added composer.sandboxTitle/ReadOnly/WorkspaceWrite/FullAccess, removed composer.modeTitle + app.askModeNotice
• tests: app-commands setMode → setSandbox; smoke queuedSends mode→sandbox; daemon_client payload asserts sandbox default; ws_e2e test_pending_ask_injects_empty_tools → test_pending_sandbox_queued_keeps_tools

Note: scheduled tasks / upgrade task unaffected — they keep their own task-level sandbox config (tasks.yml / GUI task form, #896).

Verification: pytest 982 passed + 1 skipped + 1 known doc-count fail (Agent.md 983 vs 984 collected — fixed by #897, pending merge); GUI 226/226 on the touched suites (full suite 246 pass + 7 integration, local-only by design); node --check clean.

[argszero]

✅ LGTM — cycle 1 (10 files +87/−73 + Agent.md count sync: Ask/Auto removed end-to-end — daemon allow_tools always True, ask_injected kept for signature compat (always False); GUI mode-switcher→sandbox-switcher three-tier with whitelist setSandbox; state.mode→state.sandbox with workspace-write default; sandbox on every task message (daemon_client default); i18n mode keys removed, sandbox keys added; tests updated (app-commands setMode→setSandbox, smoke queuedSends sandbox, daemon_client payload asserts default, ws_e2e ask-empty-tools→sandbox-queued-keeps-tools). pytest 982 pass + 1 skip + known doc-count resolved (Agent.md 984 folded in, #897 closed as superseded); GUI touched suites 226/226; test + test-windows CI PASS)

[argszero]

✅ LGTM — cycle 2 (independent re-review: head 4eecd70 + eeec01a; Ask/Auto removed end-to-end — daemon allow_tools always True with ask_injected kept for signature compat; GUI sandbox-switcher + state.sandbox default workspace-write; sandbox on every task message; Agent.md 983→984 folded in, resolving the master doc-count gap (#897 closed as superseded). pytest 983 pass + 1 skip on branch, GUI touched suites 207/207; test + test-windows CI PASS)

[argszero]

✅ LGTM — cycle 3 (fresh re-review: head eeec01a unchanged, CI green, MERGEABLE; full diff re-verified — daemon allow_tools always True, GUI sandbox-switcher + state.sandbox, sandbox on every task message, i18n mode→sandbox keys, ws_e2e ask-empty-tools→sandbox-queued-keeps-tools, Agent.md 984 folded in. pytest 983 pass + 1 skip, import + CLI OK; test + test-windows CI PASS)