Function default_decision 

pub fn default_decision(config: &Config, tool: &str) -> Decision

BP-5: the baseline decision for tool when NO rule in rules_for_config matches — derived from crate::config::ApprovalPolicy exactly as the agent’s gate derives it (see Agent::permissions_gate_denial_impl, which calls this).