Store a persistent decision for a tool from the settings surface. The in-stream ApproveAlways decision remains the other writer of the same rows; this endpoint exists so a grant flipped back to the policy default in settings can be re-granted without waiting for the next in-chat approval stop, and so a tool can be put on ask or denied outright. The `allow_always` policy only guards grants: it exists to keep the product from becoming more permissive, and a denial is strictly more restrictive, so it works in deployments that never enable approvals at all. An ask needs the approval gate to have any effect, so it is refused without one.