fix: ToolLoopAgent types reject supported tool approval secrets (#19883)

## Background

ToolLoopAgent already forwarded approval secrets at runtime, but
consumers could not configure HMAC-signed tool approvals without
bypassing TypeScript.

## Root Cause

ToolLoopAgentSettings omitted experimental_toolApprovalSecret, and both
prepareCall Pick types excluded it, despite ToolLoopAgent spreading
settings into generateText and streamText where the option is supported.

## Summary

Added experimental_toolApprovalSecret to ToolLoopAgentSettings and both
prepareCall input and output types, with a patch changeset.

## Testing

Added type regression coverage for string and Uint8Array secrets in
agent settings and prepareCall input and output.

## End-to-end Validation

- `pnpm -C examples/ai-functions exec tsx
src/reproduction/tool-loop-agent-approval-secret-types.ts` completed
successfully under immutable replay, confirming runtime signing and
public type acceptance.

## Related Issues

Fixes #19874

Closes #19876

---------

Co-authored-by: ai-sdk-factory <308175966+ai-sdk-factory@users.noreply.github.com>
Co-authored-by: mikeclarke <245199+mikeclarke@users.noreply.github.com>