Fix explicit action authorization guard

[CryptoJones]

Summary

• Bump omind to 3.7.5.
• Treat send it as explicit current-turn authorization for guarded global config/hook/bootstrap mutations.
• Preserve prompt text through the shared adapter and shell hook templates so explicit authorization can come from the current action payload when the turn-task file is missing or stale.
• Block side-effect actions after unauthorizing capability questions such as Can you ...?.

Fixes #121.
Fixes #122.

Tests

• uv run pytest tests/test_adapters.py tests/test_guard.py::test_global_config_mutation_requires_explicit_turn_authorization tests/test_guard.py::test_global_config_auth_can_come_from_action_prompt tests/test_guard.py::test_capability_question_blocks_side_effect_without_explicit_auth tests/test_guard.py::test_global_config_read_only_shell_commands_are_not_mutations
• uv run ruff check .
• uv run --extra dev --python /home/hermes/.local/bin/python3.11 mypy src
• scripts/test.sh

Proudly Made in Nebraska. Go Big Red! 🌽 https://xkcd.com/2347/