fix(automations): scope unattended approvals to each run

[astyfx]

Summary

• map Auto routines to true provider permission bypass so scheduled Claude and Codex runs do not stall on approvals
• carry a host-owned per-run authorization through Stave Local MCP and use it to auto-accept eligible Claude MCP elicitations and Lens CDP access
• isolate concurrent manual Lens requests and revoke automation approvals immediately when a run ends or the host service disconnects

Validation

• bun run typecheck
• bun test tests/claude-sdk-runtime.test.ts tests/codex-app-server-runtime.test.ts tests/lens-cdp-approval.test.ts tests/routine-runtime.test.ts tests/routines.test.ts tests/stave-local-mcp-manifest.test.ts tests/provider-runtime-options.test.ts tests/ipc-schemas.test.ts
• bun run build:desktop
• git diff --check

[heath-s]

Approved