chore(hardening): ask before writing files a later command executes

[devGregA]

Problem

git-cwd-write-approve approves any Write/Edit whose target is inside the git workspace, with no prompt. For source files that is the right call — editing them is the job, and the change is visible in the diff before anything runs it.

A small set of files break that assumption. Nothing executes when they are written; the next routine command executes what they now say:

• package.json → scripts.postinstall / prepare run on the next npm install
• Makefile, justfile, Taskfile.yml → next make / just / task
• .github/workflows/*, .circleci/*, .gitlab-ci.yml, Jenkinsfile → next CI run
• conftest.py, setup.py → next test/install run
• .pre-commit-config.yaml, .husky/* → next commit

So an instruction the model picked up from repo content could rewrite one of these with no prompt, and the payload runs later under whatever ran the build. This was the last remaining "injected content reaches execution" path after the earlier hardening PRs.

What changed

New execution-trigger-write-ask policy, placed immediately after the git-control ask and before auto-mode-approve — the same position the sensitive-file check occupies, and for the same reason: "it was inside the repo" is not a good enough justification to skip the prompt for these particular files.

Deliberate limits:

• Write access only. Reading package.json is routine and stays unprompted; there is a test for that.
• Basename and directory-prefix matching against the workspace-relative path, so src/package.json.ts and docs/Makefile.md are unaffected — also tested.
• Session approvals and user allow rules still win, since they sit earlier in the chain. Approving once does not mean being asked again.

Testing

• New: each trigger file asks; still asks in auto mode; ordinary source writes keep the git-cwd-write-approve fast path; a read of package.json does not fire the policy.
• Verified as real tests — and worth noting how: my first negative control was invalid. git stash push silently ignores untracked files, so the new policy file was never removed and the tests "passed" against unchanged code. Re-ran it by unregistering the policy from the chain instead, which correctly fails the 2 positive tests.
• Full agent-core-v2 suite green: 310 files / 4905 tests.
• oxlint clean on changed files (one pre-existing warning in user-configured-rule.ts, untouched here); tsc --noEmit clean.

Checklist

• Problem explained above (fork-local hardening; no upstream issue).
• Tests added that prove the change works.
• Changeset added (minor).
• No doc update needed.