fix(coding-agent): attribute tool-policy denies to the tool, not tools.approval

wrapper.ts treated every ResolvedApproval deny as a user policy, so a
bash.patterns deny told the user to remove tools.approval.bash. Share
denyError() with requiresApproval so both call sites keep the same
source/reason branch.