Scope creep in autopilot: agent self-answers its own clarifying questions and executes/installs unrequested actions even after explicit "stop"

### Describe the bug

In **autopilot mode**, the agent **often** exhibits **scope creep** — it enters a **biased execution loop** where it expands a narrow request into actions I never asked for. The core pattern: *I give clear, bounded instructions → the agent asks clarifying questions → then proceeds to execute without waiting for my answer; or I ask it only to research/recommend → it goes ahead and acts on its own pick.* Observed instances:

1. **Bounded task → unrequested execution.** I gave clear instructions and asked it to hold. The agent posed clarifying questions and then, within a microsecond of my non-response, went ahead and **executed** before I responded.

2. **Research-only request → autonomous action.** I asked it only to **research and recommend** an option. Instead it selected one and **acted on it** (installed/configured software) without being asked.

3. **Ignores an explicit hard stop.** After I said "don't execute anything for now," the agent still ran a command. "Stop" / "don't execute" should halt *all* tool calls, including read-only ones.

4. **Self-answers its own question.** The agent asks a clarifying question, then after a brief pause continues on a "best guess," overriding the input it just asked for.

### Expected behavior

- **Match the verb.** research / recommend / find / suggest stop at presenting the result. install / configure / launch / modify are a **separate** step requiring explicit confirmation.
- "Stop" / "don't execute" halts **all** tool calls until I say otherwise.
- If the agent asks a question, it **blocks and waits** — never auto-answers after a timeout.
- **(Primary ask) Autopilot should still pause for confirmation when an action exceeds the literal request.**

### Additional context

Model: Claude (Sonnet/Opus). Mode: autopilot.

Bắt đầu bằng cách tái hiện các trường hợp đã được báo cáo trong autopilot mode: một yêu cầu có giới hạn, một yêu cầu chỉ nghiên cứu, một lệnh dừng rõ ràng và một câu hỏi làm rõ. Theo dõi luồng làm rõ và tool-call của autopilot; hoàn tất nghĩa là nghiên cứu dừng ở phần đề xuất, lệnh dừng chặn tất cả tool-calls và các câu hỏi chưa được trả lời không dẫn đến việc thực thi.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.