Scope creep in autopilot: agent self-answers its own clarifying questions and executes/installs unrequested actions even after explicit "stop"

### Describe the bug

In **autopilot mode**, the agent **often** exhibits **scope creep** — it enters a **biased execution loop** where it expands a narrow request into actions I never asked for. The core pattern: *I give clear, bounded instructions → the agent asks clarifying questions → then proceeds to execute without waiting for my answer; or I ask it only to research/recommend → it goes ahead and acts on its own pick.* Observed instances:

1. **Bounded task → unrequested execution.** I gave clear instructions and asked it to hold. The agent posed clarifying questions and then, within a microsecond of my non-response, went ahead and **executed** before I responded.

2. **Research-only request → autonomous action.** I asked it only to **research and recommend** an option. Instead it selected one and **acted on it** (installed/configured software) without being asked.

3. **Ignores an explicit hard stop.** After I said "don't execute anything for now," the agent still ran a command. "Stop" / "don't execute" should halt *all* tool calls, including read-only ones.

4. **Self-answers its own question.** The agent asks a clarifying question, then after a brief pause continues on a "best guess," overriding the input it just asked for.

### Expected behavior

- **Match the verb.** research / recommend / find / suggest stop at presenting the result. install / configure / launch / modify are a **separate** step requiring explicit confirmation.
- "Stop" / "don't execute" halts **all** tool calls until I say otherwise.
- If the agent asks a question, it **blocks and waits** — never auto-answers after a timeout.
- **(Primary ask) Autopilot should still pause for confirmation when an action exceeds the literal request.**

### Additional context

Model: Claude (Sonnet/Opus). Mode: autopilot.

首先在 autopilot mode 中复现报告的案例：有界请求、仅研究请求、显式停止以及澄清问题。跟踪 autopilot 的澄清和 tool-call 流程；完成意味着研究在给出建议时停止，停止操作会阻止所有 tool-calls，未回答的问题不会导致执行。

由索引模型根据 Issue 内容生成。