Add CLI flags for permission mode and tool restrictions

[geoffjay]

Context

Child of #78. Depends on #116.

Changes

Add the following flags to the CreateAgent CLI command in orchestrator.rs:

• --permission-mode <mode> — value parser for PermissionMode enum
• --allowed-tools <tool> — repeatable flag
• --disallowed-tools <tool> — repeatable flag
• --tools <tools> — comma-separated tool list
• --skip-permissions — bool flag
• --require-sandbox — bool flag

Wire all flags into the CreateAgentRequest sent to the orchestrator API.

Files

• crates/cli/src/commands/orchestrator.rs — CreateAgent variant, create_agent() function

Acceptance Criteria

• All flags added with appropriate clap attributes
• Flags correctly populate CreateAgentRequest
• Clap parsing tests added for new flags
• --skip-permissions and --require-sandbox conflict validation (optional: warn if both false and no other restrictions)
• cargo build --workspace and cargo test -p cli pass