Require operator confirmation for project approvals file grants

[TheGreatAxios]

Implements CL-7782: a repo-committed .corbits/permissions.json previously seeded the permission gate with zero operator involvement, so a planted file could silently auto-allow destructive calls (force-push, file writes).

What changed:

• loadProjectApprovals (src/permission/store.ts) returns only entries whose fingerprint the operator confirmed; untrusted directories contribute zero approvals. hasLiteralFloor behavior unchanged.
• Grant confirmations live as trustedGrantFingerprints in the existing project-trust record (src/trust/project-trust.ts) — no second trust surface, keyed by realpath with the repo guard, so symlinked checkouts cannot inherit or confer.
• First encounter with a non-empty unconfirmed file surfaces what it would grant via loadPendingProjectApprovals/formatPendingProjectApprovals, wired into exec (stderr) and TUI (persist notice); entries stay gated regardless.
• DECISION (also recorded in code): project trust does NOT imply grant trust. Plugin/MCP trust only permits code to load or a server to connect; a grant auto-allows future tool calls with no further prompt, so each entry requires its own confirmation. No migration auto-confirms on upgrade — existing trusted projects see the first-encounter notice once instead of a silent behavior change.
• saveProjectApproval confirms what it writes (the only production writer is the interactive grant path); removeProjectApproval drops the confirmation so a replanted file re-surfaces.

Verification: bun run check green (6983 pass, 0 fail, exit 0), including new regression tests in src/permission/project-approvals-trust.test.ts driving the real gate (planted force-push + write_file patterns must ask when untrusted, apply silently when trusted + confirmed; realpath/symlink case; first-encounter surfacing).

Not merging — lands after critique.

[linear-code]

CL-7782