Function confirmation_required 

pub fn confirmation_required(policy: &PermissionPolicy, tool_name: &str) -> bool

Whether a tool call parks for confirmation.

PermissionPolicy is the only Allow/Deny/Ask decision. A YOLO lane is recorded as Allow before this is consulted, so it does not flip Ask.