Function cache_for_config 

pub fn cache_for_config(config: &Config) -> ApprovalCache

BP-10: the ApprovalCache a fresh crate::agent::Agent should carry, given a resolved config. capabilities.permissions.approvals.persist (Config::permissions_approvals_persist, false by default) is the ONE gate: off returns the pre-BP-10 in-memory cache without touching the filesystem at all.