Progressive / one-time permission grants instead of "dangerously bypass," + document yolo-mode vs sandbox

## Ask

A tester wanted the agent to poll workflow progress, but the only way to let it do that freely was the "dangerously bypass permissions" toggle -- which they (reasonably) don't want to enable or steer users toward:

> "I do not really trust the dangerously bypass permission and we shouldn't push users in that direction. There should be a way to at least enable progress tracking, otherwise I might as well use the UI."

They'd like a progressive or one-time authorization flow for low-risk, repeated actions (like polling) -- a middle ground between full bypass and doing everything in the Web UI.

## Also

Preferences don't explain how the options interact -- specifically the relationship between "yolo mode" and the sandbox. That could be documented better.

Related: #76 (per-session sandbox for agent tool execution).