zagent 0.0.234

• Remembered permission grants are no longer opaque: each grant in
  ~/.zcode/cli/grants.json now stores a bounded, secret-redacted,
  terminal-safe pattern beside its hash, so /permissions and the new
  zagent permissions command show WHAT was allowed — Bash(npm test) — allow_always — instead of a bare tool name (flock findings F14a/F14d).
  zagent permissions [list|revoke <pattern|all>|--reset] [--json] lists
  grants and revokes by pattern substring or tool name; all/--reset
  clears the store, and an empty or absent store reports no persisted permission grants without creating the file. The flock card pool gains
  permission-grants-surface.