test: cover the approval line and the policy records

Registry cases (none / once / round / grant / YOLO / denial / error / handler
record / closest answer wins), the wire cap keeping the line, the three policy
paths that record their answer, and a pretty detail that ignores the header.
The existing confirm tests now assert the line they gain.

tests/test_agent/test_confirm.py

@@ -33,7 +33,7 @@ async def test_confirm_allow() -> None:
         danger=classify_danger,
         on_confirm=on_confirm,
     )
-    assert await registry.execute("delete_path", '{"path": "a.txt"}') == "deleted a.txt"
+    assert await registry.execute("delete_path", '{"path": "a.txt"}') == "[approval] user (once)\ndeleted a.txt"
     assert len(decisions) == 1
     assert await registry.execute("read_file", '{"path": "a.txt"}') == "read a.txt"
     assert len(decisions) == 1