feat(tui): surface plane-2 rationale in the approval band

The plane-2 tool-call assessor records verified preconditions
("[PATH_OUTSIDE_WORKSPACE] …") and the server already ships them in
RiskSummaryDto.rationale, but the Go TUI's RiskSummaryDto had no
Rationale field — so the justification was silently dropped at decode
and the gate showed only an opaque tier.

Decode the rationale, carry it on Approval, and render it under the
header in the approval band (warn-marked, above the diff). This closes
the last deferred item of the plane-2 slice-1 plan: the assessment
surfaced to the approval UX. Golden test pins the rationale decode.

apps/tui-go/internal/app/server.go

@@ -261,8 +261,10 @@ func (m *Model) onSessionAnnounced(msg protocol.ServerMessage) {
 
 func (m *Model) onApprovalRequired(msg protocol.ServerMessage) {
 	risk := "unknown"
+	var rationale []string
 	if msg.RiskSummary != nil {
 		risk = msg.RiskSummary.Level
+		rationale = msg.RiskSummary.Rationale
 	}
 	info := &Approval{
 		RequestID: msg.RequestID,
@@ -271,6 +273,7 @@ func (m *Model) onApprovalRequired(msg protocol.ServerMessage) {
 		Risk:      risk,
 		ToolName:  deref(&msg.ToolName),
 		Preview:   derefp(msg.Preview),
+		Rationale: rationale,
 	}
 	if s := m.session(msg.SessionID); s != nil {
 		s.Pending = info