feat(output): emit permission_denied event on JSONL stream

[emal-avala]

Summary

Automation consuming the JSONL stream had to grep `tool_result.output` for the literal string `"Permission denied: "` to tell a policy-blocked tool call apart from a genuine tool error (file not found, timeout, etc.). That coupling silently breaks when the executor's error text changes — and it offered no way to distinguish the two user-facing deny paths at all.

Adds `Event::PermissionDenied { tool, reason, turn }` emitted alongside the existing `ToolResult` envelope. Detection pins the two exact shapes emitted by `tools/executor.rs`:

• Policy-driven Deny: `"Permission denied: {reason}"` — reason is the executor's explanation (e.g. `"path outside cwd"`)
• Interactive user Deny: `"Permission denied by user"` — synthesizes a stable reason string `"user denied at prompt"` so consumers don't have to handle missing fields

Both shapes are covered by pinning tests so a future change to `executor.rs` will fail the build here instead of silently stopping the `PermissionDenied` emission.

The existing `ToolResult` is still emitted, so consumers that don't know about the new event keep working.

Test plan

• `cargo clippy -p agent-code --tests --no-deps -- -D warnings` — clean
• `cargo test -p agent-code --bin agent output::` — 19 pass (13 prior + 6 new)
• 6 new tests:
  • standard prefix detected with reason extraction
  • user-deny prompt shape detected with synthesized reason
  • non-error results ignored (even with matching prefix)
  • generic tool errors (file-not-found, timeout) NOT tagged
  • empty reason rejected so no stray `reason=""` events
  • snake_case event shape + all required fields
• `all_events_are_single_line_json` extended to cover a multiline-reason `PermissionDenied`

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.