v0.16.3

fix(v0.16.3): server-side auto-approve for safe tools — far fewer modals

Previous diagnosis (v0.15.3) was wrong. The 'too many permission
prompts' issue wasn't 'auto' being an unrecognized mode — it was that
claude's acceptEdits mode auto-approves a much narrower band than
users expect, so most Read/Glob/Grep/git-status/npm-test/etc. calls
were still being routed through our --permission-prompt-tool and
shown as modals.

Fix lives in the server's /permission handler: before broadcasting to
the UI, short-circuit with an allowlist of read-only / well-known safe
tools and Bash command prefixes. Returns approved=true immediately,
no modal:
  - tools: Read, Glob, Grep, LS, ListFiles, TodoWrite, TodoRead, Skill
  - our own mcp__agent__* (mailbox / task list — internal)
  - Bash: ls / pwd / cat / head / tail / wc / file / stat / du / df /
    tree, git read-only (status, log, diff, branch, show, …), npm/pnpm/
    yarn list+test+--version, python info, which/whereis/type, echo,
    date, hostname, whoami, uname, node --version, plain find. Pipes,
    redirects, command chaining → not auto-approved.

Everything else (Write, Edit, NotebookEdit, WebFetch, WebSearch,
arbitrary Bash) still routes to the modal. Auto-approvals are logged
to the server console for transparency.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>