test: stabilize e2e approval and cancellation tests

[EugeneTheDev]

Summary

The E2E run on #620 (run) failed on two model-dependent tests. #620 didn't cause it: the run before it shows the same behavior and passed only by luck. This PR changes test code only.

• Default e2e model gpt-5.2 → gpt-6-luna[low]. gpt-5.2 isn't in the Codex model list anymore, so Codex used fallback metadata. In 0.160.1 that has apply_patch_tool_type: None, so the model ran apply_patch through the shell. A malformed patch came in as an execute approval, not edit, and broke applies an approved workspace file edit.

• Shell approval prompts ask for elevated permissions on the first try. In read-only mode the model sometimes ran the command in the sandbox, hit Read-only file system, and ended the turn without asking for approval (cancels every command when cancel is selected got end_turn). This applies only to the tests that expect an approval prompt.

• Cancellation test follows how Codex handles interrupts. gpt-6-luna runs commands through unified exec, and turn/interrupt doesn't kill those processes: they keep running as background terminals. The test now:

  • waits until the client has seen the command's tool call;
  • cancels and asserts the turn is cancelled and the process is still running;
  • stops the process with _session/async_task/stop and asserts it exits.

  The ACP SDK client rejects the async_task_spawned update because its schema doesn't include it, so the test uses the tool call id as the task id. For a root command they're the same.

• Fixture helpers: the fixture records tool calls, and createAuthenticatedFixture can declare AIR capabilities.

Test plan

• npx tsc --noEmit
• E2E workflow on this branch: run 38406199843. 33 passed, 2 skipped. One retry, in the exec-policy amendment test: the model mistyped the long temp path, so the saved approval rule didn't match.