fix(agent): classify run/terminal/spawn tools as Execute risk

classify_tool_risk missed execute-class tools whose names use "run",
"terminal", "spawn" or "process" rather than bash/shell/exec/command — most
notably "RunInTerminal". Such a tool fell through to ReadOnly and would
therefore auto-allow without approval in Default/AcceptEdits mode, a real gap
in the permission gate. Broaden the Execute branch to catch them; over-
classifying as Execute only ever asks for more approval, so it is fail-safe.

This was already asserted by an existing unit test (classifies_execute_tools
expects RunInTerminal -> Execute); the test only became runnable after the
rebase onto refactor/rust-backend pulled in the AppConfig test-fixture repair
that had been blocking the lib test binary. Full agent_workbench unit suite
now 32/32; the four integration suites stay green.

src/services/agent_workbench/permission.rs

@@ -64,6 +64,10 @@ pub fn classify_tool_risk(tool_name: &str) -> RiskLevel {
         || n.contains("bash")
         || n.contains("shell")
         || n.contains("command")
+        || n.contains("run")
+        || n.contains("terminal")
+        || n.contains("spawn")
+        || n.contains("process")
     {
         return RiskLevel::Execute;
     }