v0.9.4

Wire DisallowedTools through PollWorkItem → SessionDetail → QueuedWork.

Mirror of the v0.9.3 SystemPromptOverride fix. The platform's credential injection stamps disallowedTools on the Redis QueuedWork blob, but Go's strict JSON decoder dropped it at every wire-shape forwarder before the runner could consume it. Result: per-workType tool restrictions silently no-op end-to-end.

After this change: platform-side disallowedTools baselines (per-workType caveats like "no Bash/Write/Edit for backlog-writer/research/qa/acceptance") are honored end-to-end.

No new logic — 4 additive struct-field copies + 1 forward in detailToQueuedWork. Test coverage added in daemon/poll_test.go and afcli/agent_run_test.go.