feat(coordination): type ask_human questions and fail closed on automated answers

[unohee]

What

ask_human gains a typed question class, and the answer side fails closed (AGT-4514).

• Agents may mark a question clarification (informational — a fact the asker could not look up) or approval (credentials, spend, production access, an irreversible external action — a human must own it). Absent means approval.
• The class an agent supplies is a claim, not proof. The gate that makes it load-bearing is in answerHumanQuestion: an automated responder may only answer a question that is exactly clarification.
• Fails closed in the direction that denies automation. Anything not exactly clarification — absent, misspelled, or a stale enum value from an agent written before this field existed — resolves to approval, so every existing caller is refused automation rather than silently granted it.
• Human surfaces are recognised by an allowlist of the actor itself, not by a caller-supplied role: the dashboard route, a discord: actor, and OpenSwarm's own supervisor (which answers with the authority the operator delegated). A connector that omits the role, or claims human, is still treated as automated.
• A refused answer is left unsettled, so a human can still answer the question afterwards.
• Question class is persisted in the posted event's metadata, so the gate can re-read it after the fact.

Why it is safe to merge

• No change to resume/ledger behaviour: the diff touches only question posting/answering and the ask_human tool's input surface.
• Every pre-existing human surface keeps working — covered by a test that answers an approval question from each allowlisted surface.
• The default direction denies automation, so an un-updated agent loses capability it should not have had, not an ability it should have kept.

Verification

$ node --experimental-vm-modules node_modules/vitest/vitest.mjs run \
    src/coordination/humanQuestions.test.ts src/coordination/coordinationTools.test.ts
 Test Files  2 passed (2)
      Tests  48 passed (48)

$ npm run lint       # exit 0 (pre-existing warnings only)
$ npm run typecheck  # clean

Includes explicit fail-closed cases: no class ⇒ refused, omitted/human-claiming automated role ⇒ refused, clarification ⇒ allowed, refused answer remains answerable by a human.

Refs: AGT-4514