design: 为 agent_decides 定义真正的风险判断策略

[suntianc]

Related to: #139

Problem

CDF exposes agent_decides, but resolveInterruptOn() currently treats it the same as strict. The UI promise “only ask for detected risky operations” therefore has no distinct implementation.

Design work required before implementation

• Decide whether risk is classified by deterministic host rules, a separate classifier model, or another auditable policy.
• Define failure, offline, privacy, latency and provider-unavailable behavior.
• Define what evidence is visible to users and how false allow/deny decisions are diagnosed.
• Preserve the decision from ADR-0063: whatever agent_decides means, the same Conversation Approval Mode applies to the full execution tree.
• Do not fold this classifier work into umbrella: Delegated Agent Run 审批与运行协调 #139's delegated approval routing.

Exit criterion

Produce an accepted design/ADR and implementation-ready acceptance matrix for main and Delegated Agent Runs. Until then, do not claim Claude Code auto equivalence.

References

• ADR-0063
• docs/research/claude-code-subagent-permissions.md