Add approval flow for SkillsFlow workflows

[shreyas-lyzr]

Description

SkillsFlow workflows currently execute immediately without any approval step. For sensitive or multi-step workflows, there should be an approval flow that lets the user review and confirm before execution proceeds.

Proposed Behavior

• Before a workflow runs, present a summary of the steps that will be executed
• Allow the user to approve, reject, or edit the workflow before it runs
• Support per-step approval for high-risk actions (e.g. file writes, API calls, deployments)
• Optionally allow auto-approve for trusted/low-risk workflows

Use Cases

• Reviewing a multi-step automation before it modifies files
• Gating destructive operations behind explicit user confirmation
• Team environments where workflows need sign-off

Labels

enhancement

[shreyas-lyzr]

Status check — keeping this open.

The approval-flow design has gotten clearer since I filed this. Concrete shape now:

1. Workflow-level pre-execution gate — before running, present the resolved DAG of steps with their inputs. User: approve / reject / edit.
2. Per-step gate for high-risk actions — any step whose tool is annotated side_effect: high in tools/<name>.yaml requires an inline approval mid-flow. Low-risk steps run through.
3. Auto-approve allowlist — skillflows/<name>.yaml: auto_approve_steps: [...] for trusted/idempotent steps.

This pairs with the structural SOD theorem in the protocol repo's paper (paper/open-gap.md §8): the runtime-level approval gate is what makes DUTIES.md conflicts enforceable when the workflow crosses role boundaries.

Tagging help wanted + enhancement. The gate UI lives in Studio; the manifest annotations live here. Will pick this up after the API-key detection (#14) lands.