Add meaningful ACP permission flow for workspace mutations and commands

[nick-pape]

Summary

Permission flow is currently not meaningful. Host clients return cancelled, while workspace write/command tools rely on MCP annotations/descriptions rather than ACP permission negotiation.

Evidence

• packages/acp-agent/tools/smoke-client.mjs: requestPermission() always returns cancelled.
• packages/acp-host-log/src/index.ts: requestPermission() always returns cancelled.
• packages/mcp-workspace/src/tools/run-command.ts: command tool has destructive annotations but no ACP permission request path.
• packages/mcp-workspace/src/tools/write-file.ts and replace-range.ts: mutations rely on expected hashes but not ACP permission prompts.

Expected Work

• Define when Fledgling should ask the ACP client for permission.
• Bridge first-party MCP tool metadata/annotations to ACP permission requests where appropriate.
• Preserve denied/cancelled outcomes in session updates and logs.
• Add tests for allowed, denied, and cancelled permission outcomes.