fix(api): reject invalid resume confirmation with explicit error

[Pnkcaht]

What I did

Added explicit validation for /resume confirmation values so invalid inputs (e.g. "garbage") are rejected early instead of causing opaque tool execution failures.

This ensures the agent reports a clear user error when a tool call is rejected, rather than surfacing a misleading (tool execution failed) message.

Related issue

Fixes #1376

Notes

• Validates resume confirmations at the API boundary
• Adds defensive validation inside the runtime
• Invalid confirmations never reach tool execution
• Produces a clear, actionable error message for the user
• Does not change behavior for valid approve / reject flows
• Keeps backward compatibility

Tests

Before

When calling /resume with an invalid confirmation value (e.g. "garbage"):

• The API returned 200 OK despite the invalid confirmation value
• The runtime forwarded the invalid value to the agent
• Tool execution failed later with a generic (tool execution failed)
• The agent had no indication that the tool call was explicitly rejected
• From the user’s perspective, the failure looked like a tool bug, not a user input error

After

When calling /resume with an invalid confirmation value:

• The confirmation is validated immediately
• The request is rejected with a clear, explicit error
• The runtime and agent never attempt tool execution
• The user is informed that the tool call was rejected due to invalid confirmation
• The error message clearly states the allowed values (approve, reject)

Screenshot

Below is a photo of the new return.