fix(cli): report unavailable permission prompts and repair CI

[primorLee]

Description

Fixes #13178.

When an ask-tier tool call reaches the CLI without an onToolPermissionRequest callback, the CLI now distinguishes the unavailable interactive prompt from an explicit user rejection.

• represent the missing callback as a dedicated callback_missing denial reason
• surface Interactive permission prompt unavailable instead of Permission denied by user
• preserve the existing user-denial and policy-denial behavior

AI Code Review

• Team members only: AI review runs automatically when PR is opened or marked ready for review
• Team members can also trigger a review by commenting @continue-review

Checklist

• I've read the contributing guide
• The relevant docs, if any, have been updated or created
• The relevant tests, if any, have been updated or created

Screen recording or screenshot

Not applicable; this corrects the CLI's permission result and message when no interactive callback is available.

Tests

• npm test -- src/stream/streamChatResponse.permissions.test.ts
• prettier --check src/stream/streamChatResponse.helpers.ts src/stream/streamChatResponse.permissions.test.ts src/stream/toolPermissionResult.ts
• eslint src/stream/streamChatResponse.helpers.ts src/stream/streamChatResponse.permissions.test.ts src/stream/toolPermissionResult.ts

CI fixes

• Use the available FFmpeg 8.1 release in JetBrains setup; the rolling download source no longer provides the configured 7.1 artifact.
• Authenticate dependency downloads with the automatic GitHub token. Existing internal CI credentials are used when available, with a fallback for fork PRs.
• Keep VS Code dependency installation and native compilation on the repository's .nvmrc runtime. Use Node 24 for VSIX packaging, with Python 3.11 for older node-gyp dependencies that require distutils.
• Package the JetBrains core with Node 22 instead of Node 18. The application dependencies now require newer runtime APIs; the old runtime fails to load Undici with ReferenceError: File is not defined. Replace the archived packager with the maintained @yao-pkg/pkg behind the existing pkg command, and select Node 22 for binary build tools in checks and releases.
• Run the existing packaged-binary tests before JetBrains UI tests, covering ping, configuration, history, and mock-model completion.
• Wait for the project to open and focus the editor before the autocomplete UI test types. Detect the inline renderer before pressing Tab, then require the exact expected inserted response. Driver 243 exposes the renderer identity instead of its suggestion text; the final expected-text assertion is retained.
• Isolate each parallel package installation's npm cache in CI to prevent EEXIST collisions in npm cache temporary files. Developer runs retain their normal npm cache.
• Allow 20 minutes for VSIX platform builds; the Windows build reached the previous 10-minute limit before packaging completed.

Validation

All upstream PR workflows passed at final head 4936d4c1eb8becef0835597eeaf4e5ec9219ffe7:

• PR Checks: all required checks passed, including all six packaged-core application tests on Linux, JetBrains unit and autocomplete UI tests, core/GUI checks, and VS Code E2E tests with JSON and YAML configurations. The autocomplete UI test verifies the exact expected inserted response after Tab.
• CLI PR Checks: all 12 OS/Node matrix jobs, lint, and the required-check gate passed.
• VSIX builds: Windows x64, macOS ARM64, and Linux x64 builds and uploads all passed.
• Actionlint passed for the PR-check and VSIX workflows; JavaScript syntax, Prettier checks, a clean-install lockfile dry run, and git diff --check passed.
• The legacy release workflow's existing Actionlint diagnostics are unchanged. Release publishing was not exercised.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[primorLee]

I have read the CLA Document and I hereby sign the CLA