feat(.agents): add autonomous mode; clarify yolo is a flag not a mode

- Add modes/autonomous.md — third SF mode (ask/build/autonomous).
  Describes UOK dispatch loop, bash 120s timeout, fresh-context-per-unit,
  recovery/runaway-guard, and when to use vs Build.
- Add autonomous to enabled.modes in manifest.yaml.
- Update policies/yolo.yaml description: YOLO is a flag on Build or
  Autonomous, not a mode, not a Shift+Tab stop.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.agents/manifest.yaml

@@ -14,6 +14,7 @@ enabled:
   modes:
     - ask
     - build
+    - autonomous
   policies:
     - default-safe
     - yolo

.agents/modes/autonomous.md

@@ -0,0 +1,67 @@
+---
+id: autonomous
+title: Autonomous
+policy: default-safe
+enableSkills:
+  - forge-autonomous-runtime
+disableSkills: []
+includeSnippets:
+  - style
+  - principles
+  - non-goals
+toolIntent:
+  allow:
+    - read
+    - search
+    - web_fetch
+    - write
+    - exec_command
+    - git_commit
+  deny:
+    - git_push_force
+    - rm_rf
+    - drop_table
+---
+
+# Autonomous Mode
+
+Long-horizon unattended execution. SF drives the full UOK dispatch
+loop: milestone → slice → task → commit, without human confirmation
+per unit. The deterministic controller (not the LLM) reads `sf.db`
+and decides what to dispatch next.
+
+**Entry points:**
+
+- `sf run --autonomous` (CLI)
+- `sf headless next` / `sf headless autonomous` (machine surface)
+- TUI: enable via `/autonomous` or the autonomous panel
+
+**Differences from Build:**
+
+- No per-unit human confirmation gate.
+- Each task unit gets a **fresh agent context** — no accumulated state
+  between units.
+- Budget limits enforced: turn cap and token cap per unit.
+- The 120 s bash default timeout is critical here — without it a
+  single hanging command consumes the entire autonomous run budget.
+- Bash tool has a 120 s default timeout (configurable via
+  `settings.json → bash.defaultTimeoutSeconds`).
+- Recovery and runaway-guard are active; stuck units are retried or
+  abandoned automatically.
+
+**What does NOT change in this mode:**
+
+- Path deny rules and redactions from the active policy still apply.
+- Secrets are never written to commits or logs.
+- Destructive operations (`rm -rf`, `git push --force`, `drop_table`)
+  are still denied.
+
+**When to use:**
+
+Use autonomous mode when the milestone/slice plan is stable, tests are
+present, and the work is low-blast-radius. Use Build mode when you
+want to review changes interactively or the task is novel/risky.
+
+The YOLO flag (`Ctrl+Y` / `/mode yolo`) can be layered on top of
+Build or Autonomous to drop the remaining confirmation gates entirely.
+It is a flag — not a mode — and does not appear as a Shift+Tab stop.

.agents/policies/yolo.yaml

@@ -1,8 +1,10 @@
 id: yolo
 description: >-
-  Confirmation-free build mode. Use deliberately — destructive
-  operations execute without prompting. Still respects path denies
-  and redactions; only the confirmation gate is removed.
+  Confirmation-free policy applied when the YOLO flag is active
+  (Ctrl+Y / /mode yolo). YOLO is a flag layered on top of Build or
+  Autonomous — it is NOT a mode and does not appear as a Shift+Tab
+  stop. Destructive operations execute without prompting. Path denies
+  and redactions still apply.
 
 capabilities:
   filesystem: