feat(policy): map --yolo to allowedTools wildcard policy

This PR maps the `--yolo` flag natively into a wildcard policy array
(`allowedTools: ["*"]`) and removes the concept of `ApprovalMode.YOLO` as a
distinct state in the application, fulfilling issue #11303.

This removes the hardcoded `ApprovalMode.YOLO` state and its associated
UI/bypasses. The `PolicyEngine` now evaluates YOLO purely via data-driven rules.

- Removes `ApprovalMode.YOLO`
- Removes UI toggle (`Ctrl+Y`) and indicators for YOLO
- Removes `yolo.toml`
- Updates A2A server and CLI config logic to translate YOLO into a wildcard tool
- Rewrites policy engine tests to evaluate the wildcard
- Enforces enterprise `disableYoloMode` and `secureModeEnabled` controls
  by actively preventing manual `--allowed-tools=*` bypasses.

Fixes #11303

docs/reference/configuration.md

@@ -1938,19 +1938,14 @@ for that specific session.
 - **`--help`** (or **`-h`**):
   - Displays help information about command-line arguments.
 - **`--yolo`**:
-  - Enables YOLO mode, which automatically approves all tool calls.
+  - Automatically approves all actions. Equivalent to `--allowed-tools=*`.
 - **`--approval-mode <mode>`**:
   - Sets the approval mode for tool calls. Available modes:
     - `default`: Prompt for approval on each tool call (default behavior)
     - `auto_edit`: Automatically approve edit tools (replace, write_file) while
       prompting for others
-    - `yolo`: Automatically approve all tool calls (equivalent to `--yolo`)
     - `plan`: Read-only mode for tool calls (requires experimental planning to
       be enabled).
-      > **Note:** This mode is currently under development and not yet fully
-      > functional.
-  - Cannot be used together with `--yolo`. Use `--approval-mode=yolo` instead of
-    `--yolo` for the new unified approach.
   - Example: `gemini --approval-mode auto_edit`
 - **`--allowed-tools <tool1,tool2,...>`**:
   - A comma-separated list of tool names that will bypass the confirmation
@@ -2114,7 +2109,7 @@ Sandboxing is disabled by default, but you can enable it in a few ways:
 
 - Using `--sandbox` or `-s` flag.
 - Setting `GEMINI_SANDBOX` environment variable.
-- Sandbox is enabled when using `--yolo` or `--approval-mode=yolo` by default.
+- Sandbox is enabled when using `--yolo` by default.
 
 By default, it uses a pre-built `gemini-cli-sandbox` Docker image.