feat: per-node option to skip CLI first-run approval

A CLI node can set cliSkipApproval to bypass the trust-on-first-use pause and
run its command immediately. Exposed as a checkbox in the node inspector.

packages/dashboard/app/components/WorkflowNodeEditor.tsx

@@ -449,6 +449,14 @@ function InnerEditor({
                           <p className="wf-inspector-note wf-inspector-note--info">
                             Runs an arbitrary command in the task worktree. The first time this exact command runs, the task pauses for your approval. The node prompt is passed via FUSION_NODE_PROMPT.
                           </p>
+                          <label className="wf-field wf-field--checkbox">
+                            <input
+                              type="checkbox"
+                              checked={selectedNode.data.config?.cliSkipApproval === true}
+                              onChange={(e) => updateSelectedData({ config: { cliSkipApproval: e.target.checked } })}
+                            />
+                            <span>Skip first-run approval (runs without pausing)</span>
+                          </label>
                         </label>
                       ) : (
                         <label className="wf-field">

packages/engine/src/executor.ts

@@ -3479,9 +3479,11 @@ export class TaskExecutor {
     } else if (executorKind === "cli") {
       const rawCommand = typeof cfg.cliCommand === "string" && cfg.cliCommand.trim() ? cfg.cliCommand.trim() : undefined;
       if (rawCommand) {
-        // Arbitrary command: gated by trust-on-first-use approval. The exact
-        // command string must have been explicitly approved by the user.
-        if (!(await this.store.isWorkflowCliCommandApproved(rawCommand))) {
+        // Arbitrary command: gated by trust-on-first-use approval unless the
+        // node explicitly opts out (cliSkipApproval). The exact command string
+        // must otherwise have been approved by the user.
+        const skipApproval = cfg.cliSkipApproval === true;
+        if (!skipApproval && !(await this.store.isWorkflowCliCommandApproved(rawCommand))) {
           return this.pauseForCliApproval(node, live, rawCommand);
         }
         const env = prompt ? { ...process.env, FUSION_NODE_PROMPT: prompt } : undefined;