bug(core): client-initiated tool calls silently bypass ASK_USER confirmation (scheduler/policy.ts)

## What happened?

`packages/core/src/scheduler/policy.ts:76-88` silently upgrades `ASK_USER` to `ALLOW` for any client-initiated tool call:

```ts
if (
decision === PolicyDecision.ASK_USER &&
toolCall.request.isClientInitiated &&
!toolCall.request.args?.['additional_permissions']
) {
return { decision: PolicyDecision.ALLOW, rule: result.rule };
}
```

Any slash-command / client path bypasses the confirmation prompt. There is no tool allowlist, no mode gate, and no audit log — only `additional_permissions` is excluded.

## What did you expect to happen?

Client-initiated calls should still honor `ASK_USER` unless the tool is explicitly allowlisted or a policy opt-in (`modes` / auto-accept setting) permits it. At minimum the bypass should be narrowed + logged via telemetry.

## Client information

- Repo: `google-gemini/gemini-cli` @ `main` `9c1b0a610`
- Area: `packages/core/src/scheduler/policy.ts:80-85`
- Platform: Windows (source checkout), Node v22

## Login information

N/A — policy logic, reproducible from code inspection + unit test with `isClientInitiated: true` and a policy rule returning `ASK_USER`.

## Anything else we need to know?

**Fix direction:** remove blanket bypass; only bypass for explicit `ALLOW`-listed tools or require policy opt-in + telemetry log. Suggested regression test: policy returns `ASK_USER`, `isClientInitiated=true` → still `ASK_USER` unless allowlisted.

Related recent hardening: #29250 (prompt injection), #29215 (envelope provenance), #29170 (path boundaries) — this closes a remaining confirmation-bypass hole in the same trust boundary.

Start in packages/core/src/scheduler/policy.ts:76-88 and inspect the surrounding policy decision flow, then reproduce the ASK_USER case with isClientInitiated set to true. Review how explicit allowlisting, policy opt-in modes, and telemetry are represented before choosing the permitted narrowing. Done means client-initiated calls retain ASK_USER unless explicitly permitted, with a regression unit test and the requested audit coverage.

Written by the indexing model from the issue text.