[Fix] Brain proxy bypasses per-tool approval policies on the task path

[roomote-roomote]

​Opened on behalf of @mrubens. Follow up by mentioning @roomote-roomote, in the web UI, or in Slack.

Related issue

Raised by an internal security review of the per-tool integration approval work (#3069 / #3072 / #3076 / #3078); no separate tracking issue.

Why this PR exists

• A maintainer explicitly invited this PR in the linked issue or discussion
• I am a maintainer / this is internal Roomote work

What changed

The native-handler enforcement gap from that review was largely closed by #3103; this PR covers what remained after it landed.

• Brain proxy opt-in. The Brain (gbrain) runs through createMcpProxy but never set toolApprovalIntegrationId, so per-tool ask / reject policies keyed to gbrain were still unenforced on the task execution path: a task sandbox holding a run token could call /api/mcp/gbrain directly and run a tool an admin had disabled. It now opts in through credential resolution, exactly the way linear.ts does, so the proxy's existing enforcement hook (including the Auto/shadow behavior from [Feat] Automatic approvals: a decision model risk-assesses tool calls nobody has made a choice about #3084) applies.
• End-to-end coverage for the native guard. notion-tool-approvals.test.ts exercises the native-handler guard from [Improve] Consolidate MCP tool availability into approval modes #3103 through the real Notion handler: a reject policy refuses a task run's call with a 403 before any Notion API contact, an ask-first tool is held until the Session owner's approval claim succeeds, an unreadable claim fails closed, rejected tools disappear from tools/list, batch requests are refused while a block is in force, and the experiment-off path reads nothing and blocks nothing. Develop previously had only the guard's unit test.
• Status preservation. The native guard's tools/list filter now preserves the upstream response status when it re-serializes the filtered payload instead of always returning 200.

How it was tested

• The new Notion end-to-end suite (6 tests) plus the existing guard unit tests pass.
• Full MCP handler suite passes: 929 tests, including the pre-existing tool-approval-enforcement tests.
• pnpm --filter @roomote/api check-types passes; pre-push gates (oxlint, residual ESLint, check-types:fast, knip) pass.

Checklist

• The PR title follows the repo convention: [Fix], [Feat], [Improve], [Refactor], [Docs], or [Chore] followed by a user-facing description
• This PR is small and scoped to one change
• pnpm lint and pnpm check-types pass locally
• I added tests or included a clear manual validation note above
• I removed secrets, tokens, private keys, and customer data from code, logs, and screenshots
• If this change should appear in the changelog, I ran pnpm changeset

[roomote-community]

No code issues found. See task

_{Reviewed dadad21}