fix(runtime): revive AI Co-Founder tool-call gating via pi beforeToolCall

An earlier cleanup deleted HumanApprovalHook wholesale on the rationale
that the body always returned {}. That was the stub implementation, not
the feature: 版本更新.md specifies AI Co-Founder mode as "human-reviewed
execution that pauses until human review arrives". With no beforeToolCall
attached, Co-Founder and CEO modes behaved identically — a silent
regression of the product's core differentiator.

Bring the hook back with real gating logic and split the Agent
construction path by execution mode so CEO runs pay zero IPC overhead.

- HumanApprovalHook.before(): create a `dangerous_command` approval row
  for non-whitelisted tool calls, emit approval-updated, return a promise
  that resolves when a human decides.
- AUTO_APPROVED_TOOLS whitelist: read/ls/glob/grep/find/tree. Anything
  else (bash, write, edit, …) waits for human approval.
- approvalHook.resolveApproval(): invoked from wire-api-server's
  onApprovalResolved *before* automation and thread follow-ups, so the
  pi Agent unblocks the instant the human decides.
- approvalHook.cancelAll(): release every pending wait on shutdown so the
  worker can drain cleanly; wired into service-graph-pi-runtime.release.
- worker-runner: attach beforeToolCall only when job.executionMode ===
  "ai_cofounder". CEO mode constructs Agent with no hook, no RPC hops.
- WorkerRpcClient.invoke: accept per-call timeoutMs override so approval
  RPCs can wait 30min instead of the 30s default.
- worker-types schema: restore beforeToolCall in the method enum.
- RuntimeBridge.handleRpc: restore beforeToolCall branch.

No changes to approval DB schema, approval lifecycle, or existing
automation/thread handling. CEO-mode runs retain zero-IPC-per-tool
behavior from the prior cleanup.

src/main/agent-runtime/runtime-bridge.ts

@@ -4,6 +4,7 @@ import type { DesktopEvent } from "@shared/types";
 import { ensureTaskThread } from "@main/thread-integration/thread-helpers";
 import { SqliteSessionStore } from "./sqlite-session-store";
 import { CostWriter } from "./cost-writer";
+import { HumanApprovalHook } from "./approval-hook";
 import type { CredentialResolver } from "@main/credentials";
 import { getConnectorDefinition } from "@main/connectors";
 import { projectInboxMessageToPi } from "./inbox-projection";
@@ -132,17 +133,23 @@ interface ActiveRunContext {
  * - Forwards `agent-event` from the worker to the renderer (push channel).
  * - Persists each `message_end` message via `SqliteSessionStore`.
  * - Calls `CostWriter` for assistant messages with usage.
- *
- * Tool-call gating runs fully in the model layer (AI CEO and AI Co-Founder
- * both autonomous); no `beforeToolCall` / `afterToolCall` IPC hop exists.
+ * - Hosts `HumanApprovalHook` for Co-Founder mode tool gating; the worker
+ *   only invokes the hook RPC when running in `ai_cofounder` mode, so
+ *   CEO-mode runs pay zero IPC overhead.
  */
 export class RuntimeBridge {
+  readonly approvalHook: HumanApprovalHook;
   private readonly costWriter: CostWriter;
   private readonly activeRuns = new Map<string, ActiveRunContext>();
   private readonly sessionStores = new Map<string, SqliteSessionStore>();
 
   constructor(private readonly deps: RuntimeBridgeDeps) {
     this.costWriter = new CostWriter({ db: deps.db });
+    this.approvalHook = new HumanApprovalHook({
+      db: deps.db,
+      emitEvent: deps.emitEvent,
+      logger: deps.logger,
+    });
   }
 
   private registerActiveRun(context: ActiveRunContext): void {
@@ -291,7 +298,7 @@ export class RuntimeBridge {
   /** Handles RPC requests issued by the worker (`rpc-request` envelope). */
   async handleRpc(request: {
     rpcId: string;
-    method: "persistMessage" | "prepareRun";
+    method: "persistMessage" | "prepareRun" | "beforeToolCall";
     runId: string;
     payload: unknown;
   }): Promise<{ ok: true; result: unknown } | { ok: false; error: string }> {
@@ -301,6 +308,18 @@ export class RuntimeBridge {
         this.getOrCreateStore(payload.taskSessionId).appendMessage(payload.message);
         return { ok: true, result: undefined };
       }
+      if (request.method === "beforeToolCall") {
+        const payload = request.payload as {
+          agentId: string;
+          companyId: string;
+          taskId: string | null;
+          toolCallId: string;
+          toolName: string;
+          args: unknown;
+        };
+        const verdict = await this.approvalHook.before(request.runId, payload);
+        return { ok: true, result: verdict };
+      }
       if (request.method === "prepareRun") {
         const payload = request.payload as {
           connectorId: string;