fix: preserve native ACP permissions in remote Council sessions

[DylenTurnbull]

Description

Closes #403.

This change removes Mjolnir as a competing permission-policy authority for interactive and remote ACP-backed Council sessions. It preserves the ACP harness as the authority for Thor and Eitri-code native session behavior, while retaining Mjolnir-owned role boundaries for Loki and Eitri Explore.

The original report correctly identified a confusing remote Mode control and cancelled Loki/Eitri flows. Live remote protocol capture refined the root cause: the observed cancellation occurred before either worker started, when the active harness requested approval for an injected Mjolnir MCP tool and the remote host automatically cancelled an unsupported ACP elicitation form. The fix addresses both the authority mismatch and that concrete remote approval route without treating a Mode label as proof of effective harness permissions.

Key Changes:

• Stop injecting Council Manual/Auto/YOLO permission mappings into interactive and remote Thor sessions. The active ACP harness configuration now remains authoritative for those sessions.
• Keep the explicit headless --permission-mode path as a separate, deliberate headless response policy.
• Keep Loki and Eitri Explore Mjolnir-enforced read-only regardless of Thor native configuration, displayed Mode, or a remote MCP approval decision. Eitri-code remains a separate implementation session governed by its native ACP configuration.
• Replace the remote Mode selector with a read-only, live per-session Native session mode status. Mjolnir does not infer a security level from that label, persist it, set it, or reapply it.
• Move the explanatory role-boundary text into an accessible remote UI pop-up, keeping the configuration surface compact while preserving the distinction between Thor Mode and Loki/Eitri Explore restrictions.
• Reject stale or direct remote Mode-change requests server-side. Hiding the browser control alone would leave an unsupported mutation path.
• Route only the confirmed native MCP approval form for Mjolnir-injected mj-loki-pull / pull_advice and mj-code-agent / explore_agent through explicit remote choices: Allow once, Allow for session, Allow always, or Decline.
• Keep all unrelated or unsupported ACP elicitation forms safely declined rather than broadly exposing or auto-approving them.

Why these choices:

Mjolnir previously applied a Council preset to provider-native configuration and hid the provider control to avoid two contradictory controls. That design coupled Mjolnir to provider-specific permission semantics and made a remote selector look like a Council-wide authority. It also required lifecycle reapplication of a setting whose real enforcement belongs to the harness.

This PR instead uses a single-source-of-truth model: the active ACP harness defines its own session configuration and permission behavior; Mjolnir enforces role-specific constraints that it genuinely owns. The read-only Mode display is intentionally informational, not an effective-permission attestation: an ACP Mode label does not universally prove the sandbox or approval policy currently enforced by an adapter.

The remote MCP path is deliberately narrow. The live capture showed the native request requires a structured persist scope answer, not a generic yes/no response. Accepting only the two known injected Mjolnir tools and returning the user-selected native scope fixes the demonstrated flow without converting the remote viewer into a general-purpose ACP elicitation broker.

UI/Session Evidence:

• Surface(s): remote Tailscale web viewer; ACP-backed Thor session; Loki pull_advice; Eitri Explore explore_agent.
• Reproduction/workflow: start a remote session, invoke Loki or Eitri Explore from Thor, and use the displayed MCP approval card.
• Before: the remote host cancelled the native MCP elicitation before the Loki/Eitri worker started; the active harness reported a user-cancelled/rejected MCP tool call, and Loki fell back to its read-only index. The web Mode selector also appeared as an editable Mjolnir permission control.
• After: the viewer exposes the exact native approval scopes and returns the matching ACP response value. Loki advice and Eitri Explore complete after explicit approval. Mode is shown as non-editable Native session mode status, with an active-ACP-harness explanation behind a ? pop-up.
• Safety/capability boundaries: no silent grant; Decline remains available; stale/unknown approvals and unsupported/general ACP elicitation forms remain safely declined; Loki and Eitri Explore remain read-only in every native Mode.
• Visual evidence: manually reviewed in the live remote viewer; the mode status, no editable Mode selector, and ? pop-up were confirmed.

Touch Points:

• ACP/Council startup and runtime configuration inheritance.
• Remote session snapshot, config-change validation, and web configuration presentation.
• Remote pending-approval lifecycle and native MCP elicitation response routing.
• Headless-only explicit permission response policy.

Validation:

• cargo fmt --check
• cargo check
• cargo build --release
• git diff --check
• Live manual remote validation against the rebuilt Tailscale server:
  • Loki pull_advice: Allow once and Allow for session both returned the exact native persist scope and completed without error.
  • Eitri Explore explore_agent: Allow once returned the exact native persist scope; the worker started, completed, and returned its read-only report.
  • Verified absence of the prior user cancelled MCP tool call / user rejected MCP tool call result in the successful retest.
  • Verified the non-editable Mode status and its ? pop-up in the remote viewer.
• No tests were created, modified, or run. An unrelated final repository search surfaced existing test locations; those tests were not used as validation.