v0.5.0 — Permission layer

The CLI now asks before mutating tools run. Read-only tools run immediately; edit_file, write_file, bash, and spawning a sub-agent stop for consent, with session-scoped always-allow, a --yes flag for scripts and CI, and auto-deny in one-shot mode so nothing hangs. Consent follows delegated work: a gated parent cannot spawn an ungated child. Library users are unaffected (opt-in through the CLI). 119 tests green, ruff clean.