fix(runtime): add persistent permission configuration

[CxHsin]

Summary

Implements the basic persistent permission configuration requested in #3351.

The Runtime Host now owns canonical deny rules for commands and filesystem paths. The rules are persisted in Runtime Policy, exposed through the CLI/control-plane mutation, and enforced before local tool dispatch. Persistent denies apply to Bash, PTY input, file tools, and recursive Glob/Grep scopes; they take precedence over the session permission mode.

This also keeps the rules live for existing backends: glob matchers are compiled once per immutable rule snapshot, and each tool dispatch reads the current Host-owned snapshot. Updating the policy therefore affects the next dispatch without rebuilding the backend.

Fixes #3351

Scope and boundaries

• Deny rules only; this does not add allow-rule configuration.
• Enforcement happens before dispatch. A tool already in progress is not cancelled or retroactively evaluated.
• Existing command/path matching semantics and fail-closed path verification are preserved.
• This does not change shell parsing, sandbox implementation, or provider-facing tool schemas.
• Rules are Host-owned and shared by sessions in the same Runtime Host.
• Windows path normalization is preserved, with the converted rule snapshot cached alongside the compiled matcher.

Verification

Passed:

• npm run lint
• npm run format:check
• npm run build
• npm run typecheck
• npx knip --workspace apps/desktop
• npx knip --workspace packages/ui
• Core test suite: 827 passed
• Runtime persistent-permission suite: 17 passed
• Runtime Host policy coordinator suite: 18 passed, 1 skipped by the existing test condition
• Runtime Host execution-host suite: 15 passed

npm test was also attempted, but did not complete cleanly in this Windows environment. The failures were in existing platform/resource-sensitive tests involving symlink privileges, SQLite file locking, PTY/Shell behavior, and MCP/Eval external resources; the affected permission suites above pass independently.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex authored the implementation, tests, and this description. The affected commit includes the required Generated-by: Codex trailer.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — persistent deny rules now apply to the next dispatch made by an existing backend.
• No

[CxHsin]

Duplicate of #4849; the fix commit has been pushed to the existing PR branch CxHsin:codex/permission-configuration.