fix(acp): preserve permission requests by default

[wolfyy970]

#5323 and Desktop 0.5.8 restored working agents by restoring bypassPermissions as the implicit default. This follow-up removes that implicit blanket bypass while keeping it available when an operator chooses it.

The default now leaves each adapter in its normal per-request flow. For current Claude and Codex adapters, the harness selects the offered allow_once, so agents can work and publish without a stranded human prompt. Each grant remains visible to the harness, and Goose receives no unsupported mode override.

This is the safer default after the immediate recovery for #5290, #5303, #5317 and #5332. #5106 remains the full owner-facing Ask, Allow and Reject policy.

The regression drives a real fake adapter through the prompt wire, captures the exact permission response and proves the turn completes. The focused permission suite, ambient-environment regression, formatting, strict Clippy and adversarial review pass.

[wolfyy970]

@wesbillman I rechecked this exact head against the 0.5.8 main. It is mergeable and the only ACP overlap is the revert this builds on.

This keeps agents working without making blanket bypassPermissions the implicit default again. The adapter asks per operation, the harness selects the offered allow_once, and Goose gets no unsupported mode override. The production wire test passed three consecutive runs, the permission suite and ambient-environment regression pass, and the adversarial review is clean.

It is blocked only on human review now. Could you take a look when you have a window?