docs: clarify plugin MCP tool permissions

[yaodong-shen]

Closes #448

Summary

• Explain that plugin MCP servers start automatically, but their tools still use the standard MCP permission flow.
• Document how allowed_tools, disallowed_tools, permission_mode, can_use_tool, and PreToolUse hooks affect plugin MCP calls.
• Clarify that tool permission checks do not sandbox the plugin server process, so plugins must be trusted.
• Keep the public SdkPluginConfig and ClaudeAgentOptions.plugins docstrings consistent with the README.

Validation

• .venv/bin/ruff check src/ tests/ scripts/
• .venv/bin/ruff format --check src/ tests/ scripts/
• .venv/bin/mypy src/ scripts/
• .venv/bin/pytest -q: 1279 passed, 5 skipped; four process-state checks were blocked because the restricted test environment could not run ps
• .venv/bin/pytest -q tests/test_close_cancellation.py outside the restricted environment: 9 passed