Incorrect tool call approval/cancellation badge shown in Duo Agentic Chat

Summary

Tool call status badges in Duo Agentic Chat display the opposite of the actual user decision. When a user denies the first tool call and approves the second, the first badge shows "Approved" and the second shows "Cancelled" — the reverse of what actually happened.

Steps to reproduce

Open Duo Agentic Chat
When a tool call approval prompt appears, deny it
When a second tool call approval prompt appears, approve it
Observe the status badges on both tool call messages

Current behavior

First tool call (denied): badge shows "Approved"
Second tool call (approved): badge shows "Cancelled"

Expected behavior

First tool call (denied): badge should show "Cancelled" (or "Denied")
Second tool call (approved): badge should show "Approved"

Additional context

This is related to how toolDenialTransformer determines whether a tool call was approved or denied. Per the notes in !248785 (merged), the transformer uses a trailing executed tool message to distinguish an approved request from a denied one — without it, the card finalises as "Cancelled" rather than "Approved". The logic appears to be inverted or the wrong checkpoint shape is being used to resolve the final status when multiple tool calls are present in sequence.

!248785 (merged) — MSW coverage for Duo chat tool calls; notes the toolDenialTransformer behaviour that determines Approved vs Cancelled status