fix: disable rubberband in obfuscation approval test

The approval-id test for obfuscated commands (echo ... | sh) exercises the
separate obfuscation detection + approval flow. RubberBand's indirect_execution
pattern correctly catches this command, but the test needs the approval flow to
run instead. Disable RubberBand for this specific test case.

src/agents/bash-tools.exec.approval-id.test.ts

@@ -746,6 +746,7 @@ describe("exec approvals", () => {
       ask: "off",
       security: "full",
       approvalRunningNoticeMs: 0,
+      defaults: { rubberband: { enabled: false } },
     });
 
     const result = await tool.execute("call6", {