fix(agent): keep background sandbox tasks running

Auto-approve sandbox Shell only for host-bound task execution, stage native results within their owning session, and preserve active lease state on response stream loss. The repeated failures came from interactive approval in unattended runs and transport cleanup invalidating execution state; focused regressions cover both boundaries.

src/routes/chatPermissionPolicy.ts

@@ -1,5 +1,5 @@
 // Called only for native "asked" events. Explicit denials and host isolation
 // still run before this point; the selected round mode answers pending requests.
-export function canAutomaticallyApprove(mode: string, _action: string) {
-  return mode === "always";
+export function canAutomaticallyApprove(mode: string, action: string, backgroundSandboxShell = false) {
+  return mode === "always" || (backgroundSandboxShell && action === "shell");
 }