feat(safety): default to guarded review with TUI approvals

docs/usage/cli.mdx

@@ -17,7 +17,7 @@ strix (--target <target> | --target-list <path>) [options]
   When the target is an API spec, Strix copies it into the agent's workspace and authorizes the base URLs it declares (including those resolved from a Postman environment) as in-scope hosts - so the agent reads the contract and tests the full declared surface instead of discovering endpoints by crawling. Pair the spec with the deployed base URL (e.g. `--target ./openapi.yaml --target https://api.example.com`) so the agent has a reachable host to attack.
 
   <Note>
-    With safety mode `off`, a local directory is mounted into the sandbox live and **writable**, so the agent edits your real files (`.git` excepted). `guarded` and `observe` use a writable isolated copy instead.
+    By default, local directories are copied into a writable isolated workspace, so agent changes do not modify your source. With `--dangerously-disable-safety`, the directory is instead mounted live and **writable**, so the agent can edit your real files (`.git` excepted).
   </Note>
 
   <Note>
@@ -41,11 +41,11 @@ strix (--target <target> | --target-list <path>) [options]
   Scan depth: `quick`, `standard`, or `deep`.
 </ParamField>
 
-<ParamField path="--safety-mode" type="string" default="off">
-  Action policy: `off`, `guarded`, or `observe`. Guarded mode contextually
-  reviews ambiguous actions and blocks destructive or persistent effects.
-  Observe mode permits passive target interaction only. See
-  [Safety Modes](/usage/safety-modes).
+<ParamField path="--dangerously-disable-safety" type="boolean" default="false">
+  Disables contextual action review and workspace isolation for this run. This
+  can permit destructive actions and mounts local directories live and writable.
+  Safety is guarded by default in both TUI and non-interactive runs. See
+  [Action Safety](/usage/safety-modes).
 </ParamField>
 
 <ParamField path="--scope-mode" type="string" default="auto">