feat: expose a session-scoped permission bridge for external providers

[khalilgharbaoui]

Issue for this PR

Closes N/A

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

This PR adds a tiny, generic bridge that lets external providers reuse OpenCode's existing Permission.ask(...) flow.

Concretely:

• it adds a session-scoped registry on globalThis in packages/opencode/src/provider/external-permission-bridge.ts
• it registers an entry for the active session in packages/opencode/src/session/llm.ts
• that entry calls the existing permission service with the current session and ruleset
• it unregisters the bridge automatically when the stream lifecycle ends

Why this works:

• built-in providers already run through OpenCode's permission system
• external providers do not currently have a generic way to hand a provider-initiated permission request back into that same system
• this bridge exposes the smallest reusable hook possible without changing existing built-in provider behavior

This is intentionally provider-agnostic. A provider still needs to translate its own control/tool protocol into this bridge.

How did you verify your code works?

• ran local typecheck with Bun on the patched branch
• verified the branch compiles cleanly after the bridge registration/cleanup changes
• verified locally with an external-provider prototype that the provider can see the session-scoped bridge and call back into OpenCode's permission flow using the active session context

Screenshots / recordings

N/A — no UI changes in this PR.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

[github-actions]

Thanks for updating your PR! It now meets our contributing guidelines. 👍