docs: state the approval walls at their real strength

[Max17190]

Why

docs/configuration.md said an agent cannot launder a grant through env -u in bash because --approve refuses agent-spawned processes and callers with no terminal. The session marker, the attestation variable, and a terminal are all things a shell the agent runs can arrange, and the ledger record that results reads like a human's; require_human's own comment says as much. The walls stop a grant from happening by accident and hold against an agent that follows the prompt; what makes the grant a human act against an agent that sets out to take one is the hardened profile the same page describes. Governance surfaces should state the true shape where the reader looks.

Summary

• docs/configuration.md: the approvals paragraph states the walls at their real strength, says the hardened profile (an ask rule on bash) is what closes it, and says the same about the permission and trust files under ~/.openmax/ (unreachable by the confined file tools, reachable by bash).
• --spec tools: the one sentence about --approve aligned.
• hooks.rs: the module doc no longer claims hooks never inject text into the model (a pre_tool_use block reason is the call's tool result, a blocking turn_end reason is a user message); the user_prompt_submit doc keeps its narrower, true claim.

Test Plan

• Documentation and doc comments only; no behavior change. cargo test --workspace green; clippy at zero warnings.

Greptile Summary

The documentation now accurately explains the boundary between hook-authored and harness-generated refusal messages, and clearly distinguishes interactive and stdio approval behavior from headless execution. End-to-end checks confirmed the described behavior: hook-authored refusals are clipped, fail-closed harness messages are preserved, headless ask mode declines an explicit permission gate, and headless auto mode accepts it.

Confidence Score: 5/5

No blocking failure remains; the documented behavior matches the exercised product behavior.

No accepted blocking findings remain after exercising the hook refusal and headless permission-gate flows.

T-Rex Logs

What T-Rex did

• Ran a real headless OpenMax flow with an approved pre-tool hook that returned a 600-character refusal, then a second flow where the approved hook changed after approval; the hook-authored refusal was observed as 501 characters ending in an ellipsis, while the changed fail-closed message was observed as a 1,576-character reason with no ellipsis.
• Under an explicit global effect flag set to ask for write_file, the ask mode emitted a gate request and declined it, writing no file; the auto mode emitted the same request, approved it, and wrote gate-proof.txt containing accepted.
• Proof 1 corroborates the details by showing hook cap / fail-closed data and headless gate outcomes: in ask mode the gate was declined with no side effects, while in auto mode the gate was approved with side effects present.

_{Ran code and verified through T-Rex}

_{Reviews (3): Last reviewed commit: "docs: the bash ask rule holds where ther..." | Re-trigger Greptile}