Approval-mode guards, applied after register_all when the VM is
created with ExecMode::Approval. Mutating builtins stay registered
but each call is gated by its sequence index: an operation whose index
is in the approved set runs against the original inner function;
otherwise the call raises an approval request carrying the operation
descriptor so the tool-mode resume machinery can suspend and collect a
decision. A per-VM counter assigns the index and advances on every
gated call, so successive resumes admit one more operation each.
Read-only mode guards, applied after register_all when the VM is
created with readonly = true. Mutating builtins stay registered
but are replaced with stubs that raise
readonly: <name> blocked (write operations are disabled in read-only mode),
so semi-trusted scripts fail with a clear error instead of a
nil-index. Read paths (http.get, fs.read, env.get, db.query,
systemd.list_units, …) are untouched.