fix: sealed peer sync smoke + clearer approval denials (0.9.18)

CLI/Docker assert AEAD sync; status shows sealed channel; headless denials no longer pretend the user refused.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/agent_loop.c

@@ -1030,9 +1030,13 @@ static void sandbox_escalate(turn_t *t, cst_tool_ctx_t *ctx,
   }
   if (ans == CST_PERM_DENY) {
     const char *note =
-        "\n[cst: blocked by the sandbox (writes are limited to the "
-        "workspace and temp dir); the user did not allow running it "
-        "outside]\n";
+        (t->hooks && t->hooks->on_permission)
+            ? "\n[cst: blocked by the sandbox (writes are limited to the "
+              "workspace and temp dir); the user did not allow running it "
+              "outside]\n"
+            : "\n[cst: blocked by the sandbox (writes are limited to the "
+              "workspace and temp dir); no interactive approval channel to "
+              "rerun outside — use CST_APPROVAL=yolo or the TUI]\n";
     cst_buf_t b = {0};
     if (tr->out)
       cst_buf_append(&b, tr->out, tr->out_len);
@@ -1284,7 +1288,13 @@ static void exec_begin(turn_t *t, pcall_t *pc, exec_t *x) {
     pc->status = PC_DUP;
     hook_status(t, "skip duplicate read");
   } else if (!allow) {
-    set_output(pc, "denied by user", 14, 1);
+    const char *msg =
+        (t->hooks && t->hooks->on_permission)
+            ? "denied by user"
+            : "error: tool needs approval but no interactive channel is "
+              "available (headless/auto without YOLO). Set CST_APPROVAL=yolo "
+              "or CST_AUTO_APPROVE=1, or run in the TUI.";
+    set_output(pc, msg, strlen(msg), 1);
     pc->status = PC_DENIED;
     hook_tool(t, "denied", c, detail);
   } else {