docs(vercel_ai): explain privileged tool approval rule

[CodingWCal]

Change

Adds the VAI-013 threat model and rationale for Vercel AI tools that shell out or evaluate dynamic code without a tool-level needsApproval gate.

Scope boundary

AI SDK 7 moved approval to call or agent-level toolApproval. The current scanner cannot correlate that setting to a tool, so the document records it as a manual-review limitation.

Validation

• Front matter matches the production YAML
• python tools/check_rulebook.py adds no new errors
• Known baseline errors: OAI-112, PYD-106

Companion PRs

• Rules: feat(vercel_ai): detect privileged tools without approval trustabl-rules#102
• Engine: feat(vercel_ai): detect privileged tools without approval trustabl#121

Team

Justin (@jj-javascript): rationale author
Calvin: integration, SDK 7 limitation correction, and final documentation QA
Karlee (@kperpignant): consulting partner, threat model, and QA review (credited contributor)