Record Release 2 packaged Auto checklist evidence

docs/avalonia-smoke-checklist.md

@@ -84,6 +84,7 @@ Use this checklist for the Avalonia desktop app across its supported operating s
 - [ ] `R1-Q3-34` In a trusted disposable project, confirm command permissions default to Ask every time. Approve a harmless command once, then choose **Allow exact command + run** for another; verify the exact same command text in this project skips prompting in Allowlist mode, while Auto runs commands without approval. When selected from Auto, confirm the mode remains Auto. Change an argument and switch projects to verify Allowlist matching stays exact and project-scoped. Save a deny rule and verify the exact command is blocked before prompting in every mode; return to the permission manager, remove allow and deny rules separately, and verify status reports mode and rule counts. Change back to Ask every time and confirm any remaining allow rule no longer skips approval. Verify Auto runs ordinary commands, Git writes/pushes, and deletion commands without prompting unless the exact command has a saved deny rule. Open the permissions manager with many exact rules and confirm its list scrolls while the mode selector, status, and Close button stay visible. Confirm permission data stays outside the project and command review warns that commands are unsandboxed.
 - [x] **Partial Auto validation (2026-10-07, .NET 10 Release and Windows 11 packaged app, PR head `492ec41`).** Four focused policy cases passed, including the exact compound deletion/Git command from the earlier approval screenshot: Auto did not invoke the approval callback, exact Deny blocked without prompting, and a saved project Ask mode still overrode the global Auto default. The full native packaged smoke also ran an unlisted destructive command without approval, then blocked that exact command after saving Deny while Auto stayed selected. The policy test checks the decision path but does not execute the screenshot command; Allowlist scoping, many-rule scrolling, Git push in the app, and the remaining manual scenarios above remain unchecked.
 - [x] **Screenshot-command packaged Auto round-trip (2026-10-07, Windows 11, source head `6b041ef`).** A fresh self-contained Release app passed the full native UI smoke with the screenshot's exact `Remove-Item -Recurse -Force space-invaders-game/signaling; git -C space-invaders-game status --short` command. The disposable workspace contained a local Git repository and staged marker; Auto deleted the marker directory, returned successful Git status output, and showed no approval panel. The smoke then saved an exact Deny in Ask mode, returned to Auto, and verified the same command was blocked with the marker intact, no prompt, and Auto still selected. This exercises the packaged UI and real local shell in a disposable workspace; it does not attempt a Git push or close the remaining manual mode and Allowlist checks.
+- [x] **Release 2 packaged Auto confirmation (2026-10-09, merged PR #62 head `fc5987c`).** Four-RID preview [#37991522656](https://github.com/jay23606/codev/actions/runs/37991522656) passed packaged Windows UI, Linux UI under Xvfb, macOS Intel UI, and macOS ARM64 UI checks, plus each target's packaged CLI loopback check. On Windows, the native packaged UI reran the exact screenshot command above in Auto with no approval, then saved an exact Deny and confirmed the same command was blocked without side effects while Auto stayed selected. This revalidates that report on the Release 2 candidate; it does not close the broader `R1-Q3-36` matrix, which still requires ordinary/risk-flagged file and command variants, Read-only and Ask/Allowlist comparisons, and real local-model workflows.
 - [x] **Exact Cargo verification command in packaged Auto mode (2026-10-08, validation head `c4cac74`).** The Windows packaged UI smoke requested `cargo check --manifest-path space-invaders-game/signaling/Cargo.toml` as a verification command while Auto was selected. A temporary `cargo.cmd` shim logged the exact arguments and returned success; the transcript completed with `Verification PASSED (exit code 0)` and no approval panel. The four-target preview [#37718741168](https://github.com/jay23606/codev/actions/runs/37718741168) and cross-platform CI [#37718741195](https://github.com/jay23606/codev/actions/runs/37718741195) passed. This closes the screenshot-matched Cargo verification case; the broader Auto checklist above remains open.
 - [ ] `R1-Q3-35` In a disposable Git project, create a staged edit, an additional unstaged edit, and an untracked file. Open Git status and choose **Discard all unstaged…**; verify the preview lists every affected path and diff, staged content remains untouched, and confirmation restores tracked files/removes untracked files. Change a file after opening the preview and verify Codev refuses before reverting any path. Verify renames and unresolved conflicts are refused, and previews exceeding 40 unstaged paths or 40,000 diff characters direct the user to per-file revert. This action is destructive and cannot be undone.
 - [ ] `R1-Q3-36` In the same trusted disposable project, select **Auto · approve unless denied**. Confirm ordinary and instruction-risk-flagged create/edit proposals apply without a modal and appear in Files history with rollback checkpoints; verify risk matches may show an advisory but never ask for approval. Run harmless shell commands as well as disposable-project file creation/deletion, Git writes, verification, and a command chain; Auto should run each without a prompt and show command output. Confirm a saved exact deny rule blocks its matching command before execution, while a harmless variation runs. Verify commands run with the user's account permissions and have no project-folder sandbox. Confirm Read-only mode continues to use bounded file APIs for recognized inspections and Ask/Allowlist modes retain their approval behavior. New executor regressions passed locally on Windows (.NET 10.0.401, 2026-10-06): Auto executed `Remove-Item -Recurse -Force signaling; git --version` against a disposable fixture without invoking approval, and a saved exact Deny blocked the same command before deletion without prompting. Full `Codev.Tests` passed 1,023 with two opt-in live-model tests skipped. Exact-head Windows/Linux/macOS CI #37428801586 passed the same executor tests for the PowerShell and `rm -rf` branches. Packaged UI run #37430427510 also passed a real Auto `run_command` destructive compound command in an isolated private workspace, with no approval panel. This does not complete the rest of the UI/manual checklist.