fix(agent): enforce plan mode write restrictions

[YOMXXX]

Summary

• enforce plan-mode write restrictions after user and session permission merges
• deny shell/task/workflow/directory changes in plan mode while preserving plan-file edits
• keep persisted approvals from overriding explicit deny rules and constrain plan-spawned subagents to read-only tools

Fixes #870
Fixes #1274

Verification

• bun test test/agent/agent.test.ts test/agent/plan-permission.test.ts test/permission/next.test.ts test/tool/actor.test.ts --timeout 30000
• bun typecheck
• git diff --check