fix(extensions): preserve embedded permission policy

[jbachorik]

Summary

• transfer API-JAR services and permission metadata into embedded extension properties
• fail fat-agent packaging when BTrace-Extension-Permissions is absent instead of silently granting an empty set
• add repository/bridge parity tests for default denial and explicit policy approval of a privileged embedded extension
• add TestKit fixtures covering privileged, explicitly empty, and missing permission metadata

Fixes #877

Verification

• full :btrace-core:test -PtestJavaVersion=11 suite
• focused EmbeddedExtensionPermissionTest (embedded/filesystem parity, default denial, explicit allow)
• focused fat-agent TestKit cases for privileged transfer, explicit-empty transfer, and missing-metadata rejection
• ./gradlew spotlessCheck
• :btrace-gradle-plugin:compileGroovy

Baseline limitations

The complete :btrace-gradle-plugin:test run reaches five unrelated failures already present on develop: two tests use the removed registry DSL, one expects the removed registry(...) source, and two extension fixtures define a non-abstract ShadowJar incompatible with Gradle 9.5. The current plugin build also pins JUnit 6.1.2 while targeting Java 11, so TestKit verification used a temporary local JUnit 5.14.4 pin and Java 17 test launcher; neither temporary change is included in this PR.

---

This change is