Fix double transcript rows on permission and operator approvals

[TheGreatAxios]

Summary

• Accepting a permission overlay wrote two transcript rows: the generic overlay-accept echo and gate-wire's recordDecision, whose own doc comment says it exists specifically instead of that echo. Neither openPermissionsOverlay nor openOperatorOverlay ever passed echoChoice: false, so both fired.
• Esc/deny on either overlay previously wrote zero rows; auto-deny (timeout/abort) also wrote zero. All three now write exactly one, through recordDecision.
• The operator gate had no recordDecision equivalent at all. Suppressing its generic echo would have made it silent rather than de-duplicated, so a new recordOperatorDecision helper now records accept, typed answer, and cancel. A separate, previously-unconditional echo on the free-text-answer path (answered: ${text} in handleOverlayAnswerKey) was also gated on the same flag — it wasn't covered by the accept-path fix and would have kept double-printing typed answers.
• echoChoice: false is passed from gate-wire.ts's two overlay opens rather than hardcoded inside openPermissionsOverlay/openOperatorOverlay themselves. Those two openers are also called directly (with no recorder) from the standalone demo.ts fixture; hardcoding the suppression there would have silently zeroed the demo's transcript rows too. echoChoice defaults to the existing on-by-default behavior (shell.ts), so any caller that doesn't opt out still gets a row.

Operator path

onOperator had no equivalent to recordDecision, so suppressing its generic echo would have dropped the record entirely instead of de-duplicating it. Added recordOperatorDecision and wired it into all three operator terminal paths (accept, typed answer, cancel) so the operator gate keeps the same one-row-per-decision guarantee as the permission gate.

Regression note (CL-4868 / CL-5607)

CL-4868 ("no duplicate command dumps") shipped this exact guarantee pre-cutover and was marked Done. The existing gate-wire test ("gate content reaches the transcript only after the operator decides") only asserted on content (toContain), never on row count, so it kept passing at 2 rows and never caught the regression when the OpenTUI shell landed. That's the gap this PR closes with count-delta assertions instead.

Test plan

• Failing test committed first, confirmed red against the pre-fix code
• bun run test — 4088/4089 pass; the one failure (lsp-availability.test.ts) is pre-existing, environment-dependent (checks for a local language server binary), and unrelated to this change
• bun run typecheck — pre-existing unrelated failures in src/tui/tool-formatter.ts, src/util/list-dir.ts, and vendor/intx-inference (arktype narrowing), none in files touched by this branch
• bun run build — passes

[linear-code]

CL-5644