refactor(modules): re-tier approvals as default; extract self-mod as optional

Promotes approvals to the default tier with a public API (requestApproval +
registerApprovalHandler) that other modules consume. Self-modification
(install_packages / request_rebuild / add_mcp_server) moves into a new
optional module that registers delivery actions + matching approval handlers
via the new API.

## Approvals (default tier)

- Adds `src/modules/approvals/primitive.ts` exporting `requestApproval`,
  `registerApprovalHandler`, `notifyAgent`. Absorbs `pickApprover` /
  `pickApprovalDelivery` / `channelTypeOf` from the deleted `src/access.ts`.
- Rewrites `response-handler.ts` to dispatch to registered approval handlers
  on approve (action-keyed Map). Reject path is centralized.
- Drops the three self-mod-specific delivery-action registrations from
  `approvals/index.ts`; they belong to self-mod now.
- `onecli-approvals.ts` now imports picks from the primitive instead of
  `src/access.ts`.

## Self-mod (optional tier)

- New `src/modules/self-mod/` with request handlers (validate input + call
  requestApproval) and apply handlers (orchestration on approve).
- `apply.ts` owns updateContainerConfig + buildAgentGroupImage + killContainer
  calls. Self-mod depends on approvals (via registerApprovalHandler +
  requestApproval + notifyAgent) and on core (container-runner, container-config).
- Registers 3 delivery actions + 3 approval handlers at import time.

## Other changes

- `src/access.ts` and `src/access.test.ts` deleted. Tests split across
  `src/modules/approvals/picks.test.ts` (approver selection) and
  `src/modules/permissions/permissions.test.ts` (access + roles + DM).
- `src/modules/index.ts` barrel: approvals loads before self-mod so
  registerApprovalHandler is bound when self-mod registers at import time.

## Validation

- `pnpm run build` clean
- `pnpm test` — 137 host tests pass
- `bun test` in container/agent-runner — 17 tests pass
- Service starts; boot log shows `OneCLI approval handler started`,
  `NanoClaw running`; clean SIGTERM shutdown

Resolves the transitional tier violation flagged in PR #5 where core
imported from the permissions optional module via `src/access.ts`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/modules/self-mod/agent.md

@@ -0,0 +1,31 @@
+# Self-modification
+
+You can install additional OS or npm packages, rebuild your container image,
+or add new MCP servers — but only with admin approval.
+
+## Tools
+
+- `install_packages({ apt?: string[], npm?: string[], reason?: string })` —
+  adds the listed packages to your container config and rebuilds the image
+  after admin approval. Package names are validated strictly (`[a-z0-9._+-]`
+  for apt, standard npm naming with optional scope). Max 20 packages per
+  request.
+
+- `request_rebuild({ reason?: string })` — rebuilds your container image
+  without config changes. Useful if the image has drifted from config.
+
+- `add_mcp_server({ name, command, args?, env? })` — adds a new MCP server
+  to your container config. The container restarts on next message so the
+  new server is available.
+
+## Flow
+
+You call one of these tools → the host asks an admin via DM → admin approves
+or rejects. On approve, the config is applied and the container is killed;
+the host respawns it on the next message. You'll get a system chat message
+confirming the outcome (either "Packages installed..." or a failure reason).
+
+On reject you'll see "Your X request was rejected by admin."
+
+If no admin is configured or reachable, the request fails immediately with
+a chat notification explaining why.