Fixes #3760

Summary

• Preserve approved plan execution state across user-directed pauses.
• Require an explicit continuation turn before carrying approved-plan auto-approval across turns.
• Keep prose/no-list approved plans resumable even when initial todo seeding is unavailable.

Root Cause

Plan approval previously set auto-approval only for the immediate execution turn after exit_plan_mode. If the model paused for user review, that turn ended and auto-approval was reset. The next continue turn no longer had structured approved-plan state, so writer tools went through the normal approval gate and the task list could stop updating.

Fix

• Add controller-scoped approved-plan execution state.
• Split session-level approved-plan activity from per-turn continuation authorization.
• Inject an approved-plan continuation marker only for explicit continuation commands.
• Auto-allow ordinary writer tools only during the immediate approved turn or an explicit continuation turn.
• Support approved prose plans without seeded markdown todos.
• Clear approved-plan scope on completed todo_write, non-continuation input, or session/plan context changes.

Validation

• gofmt -l .
• go test ./...

Note

The desktop top-level package requires frontend/dist before go test .; without built frontend assets it fails at embed setup. This is unrelated to the controller fix.