fix: display assistant content with finish tool call + block shell write redirects

Bug 1: Assistant text content was silently dropped when the LLM response
included both content and tool calls (e.g. finish with a summary). Now
content is displayed before tool call execution regardless.

Bug 2: Shell redirect operators (>, >>, <<) allowed bypassing file-write
permissions when the base command (e.g. cat) was in the allowed list.
Redirects now require explicit user approval in permissions, and the
shell tool itself blocks them as defense-in-depth.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/agent/loop.py

@@ -216,10 +216,12 @@ class AgentLoop:
             # Successful response — reset streak
             reasoning_only_streak = 0
 
+            # Display any assistant text content (even if tool calls follow)
+            if self._display and assistant_msg.content:
+                self._display.write_assistant_message(assistant_msg.content)
+
             # No tool calls → task complete (plain text response)
             if not assistant_msg.tool_calls:
-                if self._display and assistant_msg.content:
-                    self._display.write_assistant_message(assistant_msg.content)
                 break
 
             # Execute tool calls