401c1f6cf8
`run_tests` declares `ToolCapability::ExecutesCode` and runs `cargo test`, which executes workspace code at test, build-script, and proc-macro time. Match the default approval policy for code-executing tools by returning `ApprovalRequirement::Required` explicitly instead of overriding to `Auto`. Adds a regression test pinning the approval requirement.