fix: #3359 preserve local approval rejection reasons

[Aphroq]

Summary

Preserve non-empty rejection reasons returned by local tool on_approval callbacks when recording an automatic rejection.

The public local approval callback result can include a reason, and hosted MCP approval handling already propagates rejection reasons through its own path. This change keeps shell, apply_patch, and custom local tool rejection outputs consistent with the callback decision while preserving the existing default rejection text when the reason is missing, empty, or not a string.

Test plan

• uv run pytest tests/test_shell_tool.py tests/test_apply_patch_tool.py tests/test_custom_tool.py -q
• bash .agents/skills/code-change-verification/scripts/run.sh

The focused local approval tests pass on this branch directly. The full shell verification script was run in a local validation checkout where this branch was temporarily combined with the pending tracing shutdown fix, so the tracing atexit cleanup test would not time out.

Issue number

Closes #3359

Checks

• I've added new tests (if relevant)
• I've run make lint and make format
• I've made sure tests pass