test(acp-agent): snapshot the fs sandbox escalation arc

A recorded scenario where the model writes a workspace file in one write call
with sandbox_permissions=danger-full-access + justification, the scripted
client allows once, and the escalated write lands — the fs twin of
escalation-approved, covering the fs escalation approval arc (only bash had a
snapshot before). Uses a new workspace-internal file to avoid the
read-before-edit detour, keeping the recorded path single and deterministic.

examples/acp-agent/tests/snapshots/fs-escalation-approved/input.json

@@ -0,0 +1,11 @@
+{
+  "steps": [
+    { "op": "initialize" },
+    { "op": "newSession" },
+    { "op": "setConfigOption", "configId": "permission", "value": "workspace-write" },
+    { "op": "prompt", "text": "Use the write tool (NOT bash) to create escalated.md in the current directory containing exactly the single line: escalated. An equivalent write was denied earlier, so make this one single write call with sandbox_permissions set to danger-full-access and the justification 'the user asked to escalate this write'. Do not call write without sandbox_permissions first. I will approve the permission prompt. After the result, reply with exactly the single word DONE." }
+  ],
+  "permissionAnswers": [
+    { "kind": "allow_once" }
+  ]
+}