Allow disabling built-in approvals CLI group

[kamilio]

Summary

runCLI() adds a built-in approvals command group to the root CLI.

For CLIs that do not use human-in-loop approvals, this exposes an irrelevant command in root help:

Commands:
  approvals  Inspect and execute queued approvals.

Expected

CLI authors should be able to opt out of the built-in approvals group, for example:

runCLI(root, { approvals: false })

or only include it when humanInLoop async/task-list configuration is present.

Why this matters

Small wrapper CLIs can otherwise show an approvals command that users do not need and that the CLI author did not explicitly define.

Workaround

No clean public workaround found. The group is added internally by runCLI() before command rendering.

[poe-code-agent]

Actionable and implemented in PR #247.

Summary:

• Added runCLI(root, { approvals: false }) to omit the built-in approvals CLI group.
• Added coverage for hiding the built-in group and allowing custom approvals groups when disabled.
• Documented the new Toolcraft option.

Validation passed, including the required pre-push test suite.

[kamilio]

nope