fix(desktop): Full Access by default, matching the CLI (tools no longer time out)

[agentforce314]

The bug

Every Write/Bash in the desktop app raised a permission prompt the user never saw, then failed with "permission request timed out" — six Write attempts and two Bash in one turn, so the agent gave up and pasted the file contents into chat instead of creating them.

Cause

clawcodex serve hardcoded permission_mode="default" with flags-only bypass. But both interactive entrypoints (src/cli.py, tui_launcher.py) resolve through resolve_interactive_permission_state, whose floor is bypassPermissions — the documented "Full Access by default". The desktop is the same kind of surface (a real user at the window; its own loopback, token-gated child process), so it now uses that same resolver.

That also inherits the guards that make the implicit floor safe: an operator disableBypassPermissionsMode lockdown and root-outside-sandbox both drop back to prompting, and a persisted permissions.defaultMode still wins. --permission-mode now defaults to None so the ladder applies instead of being pinned.

Second bug, same area

The renderer's approval vocabulary is manual|smart|off, and normalizeApprovalMode coerces anything unknown to "manual" — so even a Full Access session rendered as "ask every time". Added the mapping (bypassPermissions→off, auto→smart, else manual) on every session.info, plus the approvals.mode key the Safety panel and /approvals round-trip through (config.get returned the whole settings blob with no value, so the panel always showed manual; config.set had no handler at all).

Verified against a real agent (scratch workspace)

Scenario	Result
Default: "create hello.py"	✅ 0 approval prompts, file written with correct contents, turn ok
Switch to manual via the Safety path	✅ Write does prompt; approval.respond 'once' runs the tool; file written; config.get reads back manual

5 new pytest cases; 72 desktop tests green.

🤖 Generated with Claude Code