fix(brain): drop --approval-mode yolo from Gemini CLI search

yolo auto-approves every tool call, so a real-time search query could in
principle trigger write/shell tools. Default approval mode still auto-runs the
CLI's read-only web search in headless mode but never silently approves
destructive tools. Verified end-to-end: a grounded query returns a current
answer in ~23s with the account OAuth login. Test asserts yolo is absent;
specs and docs/llm_contexts.md updated.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/jarvis/tools/builtin/realtime_search.py

@@ -131,7 +131,11 @@ def gemini_cli_search(query: str, timeout: int = 30) -> Optional[str]:
     env["GOOGLE_GENAI_USE_GCA"] = "true"
     try:
         proc = subprocess.run(
-            [binary, "-p", query, "-o", "json", "--skip-trust", "--approval-mode", "yolo"],
+            # Default approval mode (no --yolo): the CLI auto-runs read-only
+            # tools like its web search in headless mode but will not silently
+            # approve write/shell tools, so a search query can't trigger
+            # destructive actions.
+            [binary, "-p", query, "-o", "json", "--skip-trust"],
             capture_output=True,
             text=True,
             timeout=timeout,