Choosing a Permission Mode for Three Different Workflows

Recommend a permission mode (and any supporting settings) for each of these three scenarios, and justify the choice:

1. A solo engineer doing exploratory research on an unfamiliar legacy codebase before deciding on a refactor approach.
2. A CI job that runs Claude Code non-interactively inside an ephemeral Docker container to auto-fix lint failures on a scratch branch, with no human available to answer prompts.
3. A team's day-to-day feature branch work, where engineers want fast iteration but still want to review diffs before they're considered "done."