Session /yolo and --yes skip classify_danger prompts; once expires after the next user turn. Hard path/command denylists unchanged.
Serialise dangerous-tool prompts under a lock so parallel tool rounds cannot race the TTY confirm.