fix: harden auto-approval timeout cancellation with backend safeguards

[0xMink]

Closes #11445

Summary

PR #11439 fixed the UI cleanup wiring so FollowUpSuggest's useEffect cleanup correctly sends cancelAutoApproval to the backend. This follow-up hardens the backend independently so stale timeouts cannot auto-commit even if the UI cancellation chain is missed.

• Hard-cancel on toggle-off: webviewMessageHandler.ts now calls cancelAutoApprovalTimeout() on the current task when autoApprovalEnabled is toggled off — independent of React lifecycle
• Defensive gate in timeout callback: The setTimeout callback re-checks autoApprovalEnabled via getState() and verifies the ask is not stale before auto-committing. Full try/catch wraps the entire async callback body to prevent unhandled rejections
• Backend regression tests: 4 tests covering explicit cancellation, defensive gate (state changed but cancel not called), superseded ask (new message arrived), and happy-path auto-select

Test plan

• New: 4 backend tests in auto-approval-timeout-cancellation.spec.ts using fake timers and mocked checkAutoApproval
• Existing: ask-queued-message-drain.spec.ts (1/1 passed), FollowUpSuggest.spec.tsx (18/18 passed)

[roomote]

Rooviewer   See task

Reviewed all 3 changed files. The defensive gate logic and the hard-cancel on toggle-off are well-structured. All 4 new tests pass. One minor suggestion:

• Add console.error to the silent catch block in Task.ts timeout callback (consistent with other catch blocks in the file)

_{Mention @roomote in a comment to request specific changes to this pull request or fix all unresolved issues.}

[roomote]

The bare catch silently swallows all errors with no logging. If getState() rejects or handleWebviewAskResponse throws, there will be zero diagnostic trace. The fail-safe behavior (don't auto-commit) is correct, but other catch blocks in this file (e.g., line 1697) log via console.error before continuing. Adding a log line here would preserve debuggability without changing the safety semantics.

Suggested change

	} catch {
	// If anything fails (state read, approval fn, or response handling),
	// do not auto-commit.
	return
	}
	} catch (error) {
	// If anything fails (state read, approval fn, or response handling),
	// do not auto-commit.
	console.error("Auto-approval timeout callback failed:", error)
	return
	}

_{Fix it with Roo Code or mention @roomote and request a fix.}