Closes #379. Three coordinated levers + a chrome banner give every
install the panic button CLAUDE.md launch-criterion #8 requires.

Lever 1 — operator env var:
- SKYTWIN_AUTO_EXECUTE_DISABLED=true on the API/worker process.
- Read ONCE at PolicyEvaluator construction (override via ctor option
  for tests so the env-var read isn't a hidden dependency).
- New early-return at the top of `evaluate()` sits AHEAD of every
  other check (trust tier, injection guard, autonomy, quiet hours,
  policy rules) so no downstream allow path can bypass it.
- Uses { allowed: true, requiresApproval: true } not deny — actions
  still land in the Approvals queue.

Lever 2 — per-user toggle:
- autonomy_settings.paused: true | false on the user row.
- New PUT /api/users/:userId/autonomy-pause endpoint sets/clears the
  flag, writes pausedAt + optional pausedReason on transition.
- AutonomySettings type gains paused, pausedAt, pausedReason fields
  in @skytwin/shared-types/user.ts.

Lever 3 — chrome banner:
- index.html ships a sticky #autonomy-banner above <main>.
- app.js updateAutonomyBanner() fetches GET /autonomy-state, renders
  operator + user lines independently, and shows a Resume button only
  for the user-pause line (operator pause needs an env-var change).
- Refreshed on every navigate() + every 30s; backed off when API
  known offline.
- New GET /api/users/:userId/autonomy-state returns combined state.

Settings page:
- New "Pause auto-execution" card with confirmation modal on both
  transitions and optional reason prompt.
- Hydrated from /autonomy-state on render; refreshes banner +
  on-page state together after a flip.
- Coexists with the existing "Pause everything (demote to observer)"
  button — different lever, clearer label.

Operator pause reason wins when both flags are set so the banner copy
reflects who set the pause.

Tests:
- 5 new policy-engine tests cover the operator-paused, user-paused,
  both-paused (operator wins), neither-paused regression, and
  isGloballyPaused() reporting matrix.
- 177 policy-engine tests, 713 API tests pass.

Safety Invariant #1 preserved: the new check strengthens the
single PolicyEvaluator.evaluate funnel rather than adding a parallel
path.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

…S sidebar; copy

Copilot review on PR #421 surfaced five issues:

1. CRITICAL — kill switch was overriding deny verdicts.
   Pre-fix the early-return at the top of evaluate() turned every
   action — including spend-cap-exceeded, domain-blocked, policy-
   denied — into {allowed: true, requiresApproval: true}. Denies are
   strictly stricter than approvals and must never be relaxed. Also
   dropped the injection-guard `confirmationLevel` for extreme-
   severity actions.

   Fix: capture killSwitchActive + killSwitchReason at the top, but
   APPLY them at the very end alongside the existing
   requiresApproval merge. Denies still short-circuit first; the
   injection guard's confirmationLevel flows through unchanged. The
   quiet-hours early-return also propagates killSwitchActive so a
   paused user can't bypass via quiet hours.

   New tests in policy-evaluator.test.ts:
   - "kill switch does NOT override a deny — domain blocklist still wins"

2. isGloballyPaused docstring claimed the autonomy-state endpoint
   used it, but the endpoint reads process.env directly. Updated
   the docstring to honestly describe both paths and note they
   agree by construction (snapshot vs live read of the same env
   var) — future refactor can collapse to one path.

3. CSS banner pushed body content down but NOT the sidebar (which
   is position: fixed; top: 0), so the banner covered the sidebar
   header. Added `.sidebar { top: 2.5rem; height: calc(100vh -
   2.5rem); }` under `body.has-autonomy-banner` so both layers
   move together. Caveat documented inline: 2.5rem assumes a
   single-line banner; two-line wrap on narrow screens needs a
   future CSS var driven from banner.offsetHeight.

4. HTML comment said the banner is "inside <main>" but it's
   actually a fixed sibling of sidebar + main. Comment updated to
   describe the actual structure + the `has-autonomy-banner`
   body-class coupling.

5. Settings prompt copy claimed pausedReason is "saved with the
   audit log" but no audit table is written today — only the
   user's autonomy_settings JSONB. Copy changed to "stored on your
   user record" to match reality. (A proper audit-log row was
   spec'd in the issue but deferred — landing the engine + banner
   first; the audit-log row can be a follow-up against an existing
   trust_tier_audit-like table.)

178 policy-engine tests pass (+1). All other tests still green.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>