feat(runtime): expose permission policies to embedders

[xenaocx-dev]

Related: #139
Proposal: #467

AI-assisted: yes. The author reviewed the implementation and understands the
runtime call paths changed by this PR.

What Problem This Solves

Applications embedding acpx/runtime cannot currently configure the existing
declarative per-tool permission policy through the public runtime contract, so
they cannot reuse its rule matching and decisions.

Why This Change Was Made

This adds an optional permissionPolicy field to AcpRuntimeOptions and threads
it through every runtime-created ACP client, including fresh and resumed
sessions, reconnects, control sessions, shutdown, and probes. Existing callback
precedence and default permission behavior are unchanged.

Path or command-argument rules are deliberately out of scope. This remains a
tool-name policy, not a sandbox or a complete security boundary.
Structured permission-escalation delivery to the embedding host is also out of
scope; the current runtime does not expose that event.

User Impact

Embedding developers can use the existing PermissionPolicy configuration
without reimplementing policy resolution in a host callback. Existing runtime
users see no behavior change unless they opt into the new field.

Evidence

• Added focused assertions for policy forwarding during fresh session creation,
  session resume, turn reconnection, control sessions, backend shutdown, and
  runtime probing.
• Updated the permissions documentation and Unreleased changelog.
• git diff --check: passed.
• pnpm run format:check: passed on 366 files.
• pnpm run check: passed with the frozen lockfile and declared ACP SDK 1.2.1,
  including typecheck, type-aware lint, builds, 860/860 main tests, and 109/109
  coverage tests.
• Coverage: 94.15% statements, 87.36% branches, 96.07% functions, 94.15% lines.
• pnpm run check:docs: passed.
• Two independent source reviews reported no remaining actionable findings.
• Repo-local autoreview (gpt-5.6-sol, high reasoning): clean; patch is correct at 0.91 confidence with no accepted/actionable findings.

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: feat(runtime): expose permission policies to embedders This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.