feat(definitions): enrich default stack — skill permissions + context7 MCP

[pedromvgomes]

Adds a skill-permissions setting definition that pre-approves the operations the bundled skills/agents need, so they run without permission prompts. Wired into stacks/default.yaml.

Renders into .claude/settings.json as:

"permissions": { "allow": [
  "Read(**/.agents/CODE-MAP.md)", "Edit(**/.agents/CODE-MAP.md)",
  "Write(./.agents/memories/**)",
  "Bash(git checkout *)", "Bash(git hash-object *)",
  "Bash(*/pre-pr-review/scripts/detect-parent.sh*)",
  "Bash(*/pre-pr-review/scripts/capture-diff.sh *)",
  "Bash(*/pre-pr-review/scripts/list-changed.sh *)",
  "Bash(*/pre-pr-review/scripts/find-convention-docs.sh*)"
] }

Why one setting: the Claude adapter merges settings at the top-level key (permissions is replaced wholesale, not deep-merged), so all allow entries must live in a single setting — splitting them would clobber. Verified by an offline --source render (permissions land correctly; _meta.agtk.managed includes permissions).

Merge Commit Message

feat(definitions): pre-approve skill/agent permissions via a setting

https://claude.ai/code/session_01SVRfip7xUQUeopATw48hpD