feat(tui): surface plane-2 rationale in the approval band

The plane-2 tool-call assessor records verified preconditions
("[PATH_OUTSIDE_WORKSPACE] …") and the server already ships them in
RiskSummaryDto.rationale, but the Go TUI's RiskSummaryDto had no
Rationale field — so the justification was silently dropped at decode
and the gate showed only an opaque tier.

Decode the rationale, carry it on Approval, and render it under the
header in the approval band (warn-marked, above the diff). This closes
the last deferred item of the plane-2 slice-1 plan: the assessment
surfaced to the approval UX. Golden test pins the rationale decode.

apps/tui-go/internal/app/model.go

@@ -91,6 +91,9 @@ type Approval struct {
 	Risk      string
 	ToolName  string
 	Preview   string
+	// Rationale holds the plane-2 verified preconditions ("[PATH_OUTSIDE_WORKSPACE] …")
+	// that justify the gate — shown in the approval band instead of an opaque tier.
+	Rationale []string
 }
 
 // Session is the UI's view of one server session.
@@ -129,13 +132,13 @@ type Model struct {
 	reconnecting bool
 
 	// sessions
-	sessions     []Session
-	selectedID   string
-	filter       string
-	workflows    []Workflow
-	wfIndex      int // -1 = not in workflow picker
-	wfVisible    bool
-	bgUpdates    int
+	sessions   []Session
+	selectedID string
+	filter     string
+	workflows  []Workflow
+	wfIndex    int // -1 = not in workflow picker
+	wfVisible  bool
+	bgUpdates  int
 
 	// input
 	editMode     EditMode
@@ -147,9 +150,9 @@ type Model struct {
 	savedBuffer  string
 
 	// flow flags
-	sessionEntered        bool
-	approvalDismissed     bool
-	pendingWorkflowFocus  bool
+	sessionEntered       bool
+	approvalDismissed    bool
+	pendingWorkflowFocus bool
 
 	// router transcript
 	routerMessages  map[string][]RouterEntry