feat(tools): always gate managed config writes behind fresh approval / 受管配置文件写入始终需人工确认

[BuGlessRB]

What

Managed Reasonix config files (config.toml, compatibility TOMLs, legacy v0.x config.json) are now gated behind the per-write fresh human approval (config_write) at any location. Previously confineWrite consulted that approval only when the target sat outside the write roots, so a root widened to cover the Reasonix home (e.g. allow_write = ["/"] or ["/home/u/.reasonix"]) turned config edits into plain allowed writes, silently editable even in YOLO.

Why

These files configure providers, sandbox rules, permissions, and MCP servers for future sessions. No posture (YOLO included) and no widened root should let an agent rewrite them unattended - the write-access auto-allow and the managed-config questions are deliberately separate gates.

Behavior

• confineWrite now checks managed.Match(target) before root confinement, so the approval fires whether or not the roots cover the file.
• Fail-closed message updated: it no longer suggests widening [sandbox] allow_write, which no longer authorizes Reasonix config edits.
• Non-config writes are unchanged: still confined to the roots; plain in-root writes never consult the approver.
• Session-data/security guard still applies ahead of the approval (settings.json, session stores stay hard-protected).

Verification

• New test TestManagedConfigWriteAsksEvenInsideRoots: in-root managed config write fails closed without an approver, consults the approver when one is present (approve/decline both covered), and a plain in-root file still writes silently.
• go test ./internal/tool/builtin/ ./internal/control/ ./internal/boot/
• go vet on the touched packages, go run ./tools/repolint clean.

Documentation-impact: none - internal approval-gate behavior; no docs describe the root-relative config_write trigger.

Cache-impact: none - the provider-visible prefix (base prompt + tool schemas + memory) stays byte-identical; the change is confined to write-tool runtime enforcement and one fail-closed error message, with no tool schema, prompt, or memory edits.

Cache-guard: go test ./internal/tool/builtin/ -run TestManagedConfigWriteAsksEvenInsideRoots (pins in-root managed-config writes still consult the approver); no tool schema changed, so the provider-visible tool surface is unchanged.

System-prompt-review: comment-only edit to internal/boot/boot.go (no code change); system prompt and tool schemas unchanged - reviewed by the PR author (BuGlessRB) and maintainer (SivanCola).