docs(skills): explain per-argument approval granularity as security gate

[Aaronontheweb]

Summary

• Adds an Approval Prompts section to netclaw-operations SKILL.md explaining that shell and file tool approvals are per-binary-and-arguments by design, not per-binary
• Documents why sleep 5 and sleep 10 appear as distinct approval patterns: the same extraction mechanism gates rm foo.txt vs rm ~/.netclaw/netclaw.db and kill 12345 vs kill \$(pgrep netclawd) — weakening it would undermine the security gate across all binaries
• Explicitly instructs the agent not to propose a hardcoded inert-binary bypass list (any such list becomes a silent privilege-escalation path the moment an entry turns out not to be truly inert)
• Bumps metadata.version 1.11.0 → 1.12.0 per the System Skills Sync Rule in CLAUDE.md

Context

Investigation started from a user observation that NetClaw was prompting separately for sleep 5, sleep 10, and sleep 30 in the same session, with a hypothesis that this was a side effect of the path-matching logic added in commit ca389b5 (#617). The path-matching commit turned out to be unrelated — it only affects file_write/file_edit.

The shell behavior comes from ShellApprovalMatcher.ExtractPatterns calling ShellTokenizer.ExtractVerbChain, which keeps the second token as part of the approval pattern when that token isn't a flag, path, URL, env var, or glob. Bare numbers and bare words fall through. After walking through the design space, we concluded this is a feature, not a bug: per-target approval is exactly what gates destructive commands, and any "inert binaries" bypass list would be a silent privilege-escalation vector.

No code changes. The only artifact is documentation so the next operator (or future self) who hits the prompt cadence doesn't go hunting for a bug and doesn't propose a bypass list.

Test plan

• Verify the SKILL.md frontmatter remains valid (schema checks via CI)
• Confirm the version bump is picked up by CI skill publishing on next release tag
• Re-read the new section to confirm it explains why the behavior exists, not just what it is