merge: Resolve conflicts with main, add user-scoped DB methods

Merge main's security hardening (user-scoped job/conversation access,
cargo-dist config, CI improvements) into turso branch.

Add Database trait methods for user-scoped operations:
- list_sandbox_jobs_for_user
- sandbox_job_summary_for_user
- sandbox_job_belongs_to_user
- conversation_belongs_to_user

Implemented in both postgres and libsql backends.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

src/agent/agent_loop.rs

@@ -1082,9 +1082,16 @@ impl Agent {
                     m
                 });
 
-            let result = reasoning.respond_with_tools(&context).await?;
+            let output = reasoning.respond_with_tools(&context).await?;
 
-            match result {
+            // Track token usage for budget enforcement
+            tracing::debug!(
+                "LLM call used {} input + {} output tokens",
+                output.usage.input_tokens,
+                output.usage.output_tokens
+            );
+
+            match output.result {
                 RespondResult::Text(text) => {
                     // If no tools have been executed yet, prompt the LLM to use tools
                     // This handles the case where the model explains what it will do
@@ -1148,11 +1155,38 @@ impl Agent {
                         if let Some(tool) = self.tools().get(&tc.name).await {
                             if tool.requires_approval() {
                                 // Check if auto-approved for this session
-                                let is_auto_approved = {
+                                let mut is_auto_approved = {
                                     let sess = session.lock().await;
                                     sess.is_tool_auto_approved(&tc.name)
                                 };
 
+                                // For shell commands, override auto-approval for
+                                // destructive patterns that should always require
+                                // explicit per-invocation approval.
+                                if is_auto_approved && tc.name == "shell" {
+                                    if let Some(cmd) = tc
+                                        .arguments
+                                        .as_str()
+                                        .and_then(|s| {
+                                            serde_json::from_str::<serde_json::Value>(s).ok()
+                                        })
+                                        .and_then(|v| {
+                                            v.get("command")
+                                                .and_then(|c| c.as_str().map(String::from))
+                                        })
+                                    {
+                                        if crate::tools::builtin::shell::requires_explicit_approval(
+                                            &cmd,
+                                        ) {
+                                            tracing::info!(
+                                                "Shell command '{}' requires explicit approval despite auto-approve",
+                                                cmd.chars().take(80).collect::<String>()
+                                            );
+                                            is_auto_approved = false;
+                                        }
+                                    }
+                                }
+
                                 if !is_auto_approved {
                                     // Need approval - store pending request and return
                                     let pending = PendingApproval {