fix(coding-agent): corrected tool resolution and conditional auto-qa session config

- Replaced getTool with getExecutableTool in CursorExecBridgeOptions to prioritize mounted-device permission wrappers over canonical tools.
- Updated createAgentSession to check isAutoQaEnabled against restricted tool filtering when configuring system prompts.
- Added test coverage verifying execution overrides preserve approval gates and restricted sessions omit auto-qa guidance.

packages/coding-agent/test/cursor-exec.test.ts

@@ -149,8 +149,8 @@ describe("CursorExecHandlers mounted tool bridge", () => {
 		};
 		const handlers = new CursorExecHandlers({
 			cwd: ".",
-			tools: new Map(),
-			getTool: name => (name === mountedTool.name ? mountedTool : undefined),
+			tools: new Map([[mountedTool.name, mountedTool]]),
+			getExecutableTool: name => (name === mountedTool.name ? mountedTool : undefined),
 		});
 
 		const result = await handlers.mcp({
@@ -187,8 +187,10 @@ describe("CursorExecHandlers mounted tool bridge", () => {
 		const settings = Settings.isolated({ "tools.approval": { ast_edit: "deny" } });
 		const handlers = new CursorExecHandlers({
 			cwd: ".",
-			tools: new Map(),
-			getTool: name => (name === device.name ? (wrapped as unknown as AgentTool) : undefined),
+			// The canonical map contains the undecorated mounted tool. The execution
+			// override must win or Cursor bypasses the approval gate.
+			tools: new Map([[device.name, device]]),
+			getExecutableTool: name => (name === device.name ? (wrapped as unknown as AgentTool) : undefined),
 			getToolContext: () => ({ settings }) as AgentToolContext,
 		});