Make auto-review on-request prompt more proactive

[maja-openai]

Why

on-request approval policy text is currently tuned for user-reviewed approvals. For auto-reviewed productivity runs, likely sandbox blocks should be escalated earlier so commands that need remote services, authentication, or other out-of-sandbox access do not first fail or hang inside the sandbox.

What changed

• Adds a separate on_request_auto_review.md permissions prompt selected for AskForApproval::OnRequest with ApprovalsReviewer::AutoReview.
• Keeps the normal user-reviewed on-request wording unchanged.
• Makes the When to request escalation bullets more explicit about likely sandbox blocks, network access, remote auth/cluster/cloud/database access, out-of-sandbox environment access, git operations that may write lock files, and short-timeout reruns after likely sandbox-blocked attempts.
• Omits approved command prefix and prefix_rule guidance for the auto-review on-request prompt.
• Adds prompt tests covering the auto-review path, normal on-request wording, and inline permission request behavior.