Classifier-only tools can now be flagged instead of blocked in auto mode

What

• Tools that declare classifierOnly() are now always evaluated by the auto mode classifier — saved always-allow rules and hook-based allows are ignored, and outside auto mode such tools are denied with a message naming the tool.
• These tools can now set onBlock: 'flag'. When the classifier would otherwise block the action, refuse to review it, or return no verdict, the action is now delivered (allowed) instead of denied, but annotated with a decisionReason noting it was "Flagged by the classifier, delivered with its warning: ...".
• A new guard denies the action with an explicit bug message if a classifier-only tool serializes to an empty classifier input, since the classifier would have nothing to judge.
• The core auto-mode permission pipeline now checks each tool's classifier-only config: if onBlock === "refuse" and a hook asked for a prompt (or the host re-asks on every allow), it denies with an explanation; if onBlock === "flag", it forces the new allow-with-flag outcome.

Why This lets certain sensitive tools stay strictly gated by the auto-mode classifier (never allowed by saved rules or hooks) while giving them a softer failure mode: instead of silently blocking an action the classifier is unsure about, Claude Code can deliver it with a visible warning explaining why it was flagged.