fix(engine): a hook's ask forces the prompt over remembered grants

A tool_call_before hook that returns `ask` set approval_required, but not
approval_force_prompt. Typed ask-rules, the safety floor and repo law set
both. Both approval resolvers let a remembered grant answer a request
without force_prompt: authority.rs:740, used by the TUI and by
runtime_threads. So after "approve for session" on `npm run deploy`, a
hook that later asks again for deploys (for example, because a freeze
file appeared) was answered by the old grant, and the command ran
without a prompt. docs/HOOKS.md says `ask` forces the interactive
prompt, and the engine's own ask-rule comment says hook asks stay
monotonic against remembered grants.

The hook branch now sets approval_force_prompt too. The
!auto_approve guard is unchanged, so Full Access behaves as before, and
a later Block from a typed rule still overrides it.

Found by the 2026-10-17 fail-open hunt (verifier confidence high).
Receipts: CW/artifacts/failopen-hunt-20261017/round2.json.

Verification: the core:: filter in the run described in 92f900edf0
covers turn_loop (4819 passed; the failures there are unrelated). clippy
with the CI flags and fmt: clean.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01NBKbhx19BRbZtvWK8rVKjz

CHANGELOG.md

@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+- A `tool_call_before` hook that answers `ask` now always shows the approval
+  prompt, as `docs/HOOKS.md` promises. Before, an earlier "approve for
+  session" or a conversation grant for the same command answered it
+  silently, so a hook could not re-gate a command the person had already
+  approved once.
 - `validate_data`, `review` and `verify` honor the read deny-list, as `read`
   does. They read files such as a workspace `.env`, or in trust mode
   `~/.aws/credentials`, without the check. `validate_data`'s TOML parse

crates/tui/CHANGELOG.md

@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+- A `tool_call_before` hook that answers `ask` now always shows the approval
+  prompt, as `docs/HOOKS.md` promises. Before, an earlier "approve for
+  session" or a conversation grant for the same command answered it
+  silently, so a hook could not re-gate a command the person had already
+  approved once.
 - `validate_data`, `review` and `verify` honor the read deny-list, as `read`
   does. They read files such as a workspace `.env`, or in trust mode
   `~/.aws/credentials`, without the check. `validate_data`'s TOML parse

crates/tui/src/core/engine/turn_loop.rs

@@ -2105,6 +2105,7 @@ impl Engine {
             // ORs `approval_required`.
             if hook_requires_approval && !self.session.auto_approve {
                 approval_required = true;
+                approval_force_prompt = true;
             }
 
             if blocked_error.is_none() {