Route codemode run_code APPROVAL_REQUIRED folders through the permission system

What

codemode's run_code can mount any folder read-only per call, but folders outside a configured allow-list return APPROVAL_REQUIRED with no path for the user to actually approve them. jcode already has a permission system; this would wire the two together.

Suggested change

In the MCP tool-result path, detect a codemode run_code result beginning APPROVAL_REQUIRED: and route it through SafetySystem::request_permission (crates/jcode-base/src/safety.rs):

• PermissionRequest { action: "mcp_mount", description: <path>, urgency: High, wait: true, ... }
• Approved → re-invoke run_code with that path; Denied → surface the reason to the model

Edge cases

• String-prefix detection is hacky; a structured approval_required result from codemode would be cleaner.
• "Approved once" should not persist into codemode's allow-list — needs a one-shot pass, not a config write.
• wait: true blocking inside a tool call (vs ambient) is unverified.

Start in the MCP tool-result path and read SafetySystem::request_permission in crates/jcode-base/src/safety.rs, then trace how codemode run_code returns APPROVAL_REQUIRED. Implement the permission request and approval or denial flow, while verifying whether wait: true can block inside a tool call. Done means an approved path is retried once without changing codemode's allow-list, and denial reaches the model.