fix(terminal-security): honor Automatic mode for run_terminal_command

[santhiprakash]

Description

Fixes #13035 (also addresses #10512).

Setting run_terminal_command to Automatic previously had little effect: terminal security evaluation demoted Automatic (allowedWithoutPermission) back to Ask First for any command outside a small allowlist (e.g. npm install, msbuild, curl …). Other tools honor Automatic as expected, so this felt like a broken setting.

Maintainer direction on #10512: keep hard failures for critical commands (e.g. rm -rf), and stop re-prompting for everything else when the user chose Automatic.

Problem

• Input: Tools → Built-in → run_terminal_command = Automatic; agent runs a normal command (npm test, msbuild, etc.)
• Wrong: IDE still requires manual Accept for nearly every command
• Expected: Automatic auto-executes non-critical commands; only critical commands stay blocked

Triage / Root cause

evaluateTerminalCommandSecurity in @continuedev/terminal-security starts from the user's base policy, then getMostRestrictive with per-command risk checks. For non-allowlisted commands that evaluation returns allowedWithPermission, which overrode Automatic. Ask First was effectively forced for most agent terminal use.

Fix

• When base policy is Automatic, only honor tightenings to disabled (critical commands)
• Do not demote Automatic → Ask First for high/medium/unknown risk
• Ask First behavior unchanged (still prompts; high-risk classification coverage kept in tests)

Checklist

• I've read the contributing guide
• The relevant docs, if any, have been updated or created
• The relevant tests, if any, have been updated or created

Screen recording or screenshot

N/A — non-visual policy evaluation change; covered by unit/thunk tests.

Tests

• packages/terminal-security: updated High/Medium risk coverage to assert Ask First still prompts; added Automatic mode honors base policy cases (auto-approve high-risk/unknown; still disable rm -rf / sudo)
• gui thunk: regression that Automatic run_terminal_command auto-calls tools/call when policy evaluation returns Automatic
• Local: cd packages/terminal-security && npm test → 230 passed

Notes / Risks

• Related open PR feat: add allowedUnrestricted mode for tool calling #10646 proposes a separate allowedUnrestricted mode (skips even critical disables). This PR is narrower: make existing Automatic work as labeled, per run_terminal_command still need Accept even if I set it to automatic #10512 maintainer note, without a new policy enum.
• Critical disables (rm -rf /, sudo, etc.) remain enforced under Automatic.

[santhiprakash]

I have read the CLA Document and I hereby sign the CLA