feat: Expose createPermissionMiddleware via messenger

[FrederikBolding]

Explanation

Exposes createPermissionMiddleware via the messenger by moving it from getPermissionMiddlewareFactory to a public function that can be exposed via MESSENGER_EXPOSED_METHODS. This should be backwards compatible as the code was previously being made available via a property on the class and getPermissionMiddlewareFactory was not exported externally.

References

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

---

Note

Medium Risk
Exposes a new messenger-callable action that returns JSON-RPC middleware used to gate restricted methods, which touches permission enforcement paths and could affect request routing if misused or wired incorrectly.

Overview
PermissionController.createPermissionMiddleware is now a real public method (implemented directly in PermissionController) and is added to MESSENGER_EXPOSED_METHODS so it can be invoked via the messenger.

This introduces a new action type PermissionController:createPermissionMiddleware (exported from index.ts) and removes the old internal getPermissionMiddlewareFactory/permission-middleware.ts factory module. The changelog is updated to note the new messenger exposure.

^{Reviewed by Cursor Bugbot for commit 7e99a17. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit e2aef0d. Configure here.}