feat(policy): implement auto-add feature with safeguards

schemas/settings.schema.json

@@ -1255,6 +1255,13 @@
           "markdownDescription": "Sandbox execution environment. Set to a boolean to enable or disable the sandbox, or provide a string path to a sandbox profile.\n\n- Category: `Tools`\n- Requires restart: `yes`",
           "$ref": "#/$defs/BooleanOrString"
         },
+        "sandboxFlags": {
+          "title": "Sandbox Flags",
+          "description": "Additional flags to pass to the sandbox container engine (Docker or Podman). Environment variables can be used and will be expanded.",
+          "markdownDescription": "Additional flags to pass to the sandbox container engine (Docker or Podman). Environment variables can be used and will be expanded.\n\n- Category: `Tools`\n- Requires restart: `yes`\n- Default: ``",
+          "default": "",
+          "type": "string"
+        },
         "shell": {
           "title": "Shell",
           "description": "Settings for shell execution.",
@@ -1425,6 +1432,13 @@
           "default": false,
           "type": "boolean"
         },
+        "autoAddPolicy": {
+          "title": "Auto-add to Policy",
+          "description": "Automatically add \"Proceed always\" approvals to your persistent policy.",
+          "markdownDescription": "Automatically add \"Proceed always\" approvals to your persistent policy.\n\n- Category: `Security`\n- Requires restart: `no`\n- Default: `true`",
+          "default": true,
+          "type": "boolean"
+        },
         "blockGitExtensions": {
           "title": "Blocks extensions from Git",
           "description": "Blocks installing and loading extensions from Git.",