Add owner approvals and private assistant handoff panel for UI mode

[wauputr4]

Goal

Ensure UI mode never makes private-agent execution feel automatic or hidden.

Scope

• Show when a message requests or recommends private assistant delegation.
• Require explicit owner action before running a private assistant job in UI mode.
• Display sanitized PrivateAgentJob preview before execution.
• Display structured PrivateAgentResult and let Wasila own the final customer reply.
• Record audit metadata for the approval and result.

Acceptance criteria

• Owner can approve/skip a handoff from the UI.
• Private assistant never receives customer-channel credentials.
• Private assistant never sends directly to the customer.
• The UI clearly labels local subprocess execution as not an OS/container sandbox unless that hardening is later implemented.