Delegate task authorization to agent hosts

[loonghao]

Summary

• delegate task approval to the connected MCP Agent host and remove the Windows Hello/F-key confirmation step
• expose portable authorize/revoke tools on every supported platform for Codex, DSH, Claude, WorkBuddy, and other MCP clients
• preserve retained proposal scope, exact target, expiry, revocation, and per-operation enforcement; document the trust-boundary change in ADR 0028

Validation

• cargo test -p dcc-cua-cli (208 unit, 32 CLI, 1 capability parity)
• cargo clippy -p dcc-cua-cli --all-targets -- -D warnings
• cargo fmt --all -- --check
• cargo hakari generate --diff
• cargo hakari manage-deps --dry-run
• scripts/check-rust-layout.ps1

Security contract

The MCP connection owner now owns user approval. Clients must enforce their own approval policy before calling authorize_task. DCC-CUA still rejects free-form approval, caller-supplied grants/receipts/capabilities, target substitution, and scope widening.