core/agent: let YOLO mode skip YOLO-tagged soft confirms

`--yes` / `/yolo on|off|once` clears the prompt of a `YOLO`-tagged tool: interpreter runs (`run_argv`, `run_argv_batch`, `open_pty`), the file mutations (overwrite / copy / move / delete) and `fetch_local`'s cleartext and mutating requests. A tool without the tag still asks, and hard path/command denylists stay untouched.

`classify_danger` now answers with a `DangerReason` — the reason text plus `yolo_skip` — so one call can refuse that skip: a command that runs through `sudo` / `su` / `doas` / `pkexec` (as the program or a wrapper) keeps its confirm whatever YOLO mode says. It never adds a reason of its own, so the program the denylist gate already asks about is not asked twice.

`prepare_batch_confirm` leaves the covered calls out, so a skipped call neither prompts on its own nor takes a slot in the round's aggregated prompt, and one escalating step keeps the whole batch in front of the human.

tests/test_cli/test_repl_commands.py

@@ -486,8 +486,8 @@ async def test_yolo_rebuilds_tool_registry(tmp_path: Path) -> None:
     )
     try:
         assert st.agent.tools is not None
-        # Soft-confirm hooks stay installed; YOLO mode does not bypass
-        # dangerous invocations — internal danger classification takes precedence.
+        # Soft-confirm hooks stay installed; YOLO mode only auto-approves the
+        # confirms of YOLO-tagged tools, so the others still prompt.
         assert st.agent.tools.soft_confirm is True
         assert st.agent.tools.yolo is False
         st.set_yolo("on")