Whether persisted trust may satisfy the policy.
Headless runs set this to False: executing repository hooks there requires
an explicit opt-in, so a workspace remembered during an interactive session
must not silently qualify a later dcode -n invocation.
