fix(permissions): scope external path approval per call

[XingYu-Zhong]

Summary

• Rebuilds the valuable external-path approval behavior from fix(permissions): request approval for external workspace paths #887 on the current develop branch.
• Keeps trusted-workspace mode efficient while making each external mutation explicit and single-use.
• Follow-up to [Feature] 关于权限设置的一些建议 #869.

Changes

• Opts only the write and edit tools into exact per-call external-path approval.
• Resolves and records the approved physical file identity, strips caller-supplied grants, and mints the grant inside the host.
• Revalidates the approved single-link inode with a no-follow file handle and performs the mutation through that same handle.
• Fails closed for external file creation, where Node does not expose a portable parent-directory openat primitive.
• Rejects sibling-prefix, symlink, hard-link alias, casing, and approval-to-mutation path swaps.
• Normalizes trailing path separators with a linear scan, including adversarial repeated-separator coverage.

This protects the approval workflow from path redirection; it is not an OS-level lock against a hostile same-user process racing the final system call.

Tests

• Focused permission/path tests (89 passed).
• Full Kun suite (2158 passed, 1 skipped).
• Kun and root typecheck/build, ESLint, and git diff --check.

Original contribution and problem analysis: @luoye520ww in #887.

Replaces #887.

[github-actions]

PR checks failed. Please fix the failing CI jobs before merging.

Failed jobs:

• Ad-hoc macOS packaged validation (PR)

Run details: https://github.com/KunAgent/Kun/actions/runs/29674204821

Transient macOS packaged-extension guest-target timeout; the failed job was rerun in isolation and the complete workflow passed on the same PR head.