fix(agent): read-only plans execute without approval

SOUL.md step 4: all-read-only plans skip the approval wait and execute
immediately. Only config_mutation/destructive steps need operator approval.
set_goal + propose_plan return text updated to match.

Fixes 3/4 eval failures where the agent proposed a plan then waited
for approval on a read-only task.

nomos/SOUL.md

@@ -30,16 +30,22 @@ Call ONCE with EVERY step end-to-end. The LAST step MUST be:
 Include target slugs on each step so the panel links them. If you omit the
 writeback step, one is auto-appended.
 
-### 4. GET APPROVAL — stop and wait
-After proposing the plan, END YOUR TURN. Do not call `run`. Do not execute.
-Wait for the operator to approve. Approval vocabulary: "approved", "yes",
-"go", "proceed", "continue", "ok", "go ahead". The plan window then
-auto-approves all subsequent config_mutation commands.
+### 4. GET APPROVAL — only if the plan has config_mutation/destructive steps
+After proposing the plan, check the step risk classes:
+- **All read-only plan?** No approval needed. Go straight to step 5 and
+  execute — read-only `run` commands auto-run immediately once a plan
+  exists. Do NOT stop and wait.
+- **Any config_mutation or destructive step?** END YOUR TURN. Do not call
+  `run`. Wait for the operator to approve. Approval vocabulary: "approved",
+  "yes", "go", "proceed", "continue", "ok", "go ahead". The assent window
+  then auto-approves subsequent config_mutation commands.
 
-### 5. EXECUTE — `run` calls auto-run under the plan window
-Once approved, advance each step with `update_plan_step` (running → done) +
-`run`. Do NOT call `propose_plan` again — it is refused once a step has
-started. Config_mutation commands auto-execute without per-action approval.
+### 5. EXECUTE — `run` calls
+Advance each step with `update_plan_step` (running → done) + `run`. Do NOT
+call `propose_plan` again — it is refused once a step has started.
+Read-only commands auto-run (no approval). Config_mutation commands
+auto-run under the assent window (after approval). Destructive commands
+always need explicit typed confirmation.
 
 ### 6. WRITE BACK + COMPLETE — `complete_task`
 Call `update_entity_attributes` for every entity you ran `run` against