fix(acp): Constrain permission option kinds to the ACP schema

[reneleonhardt]

Summary

PermissionOption.Kind was a free-form string, so nothing at compile time or runtime prevented sending a kind outside the ACP schema. The schema enum (agent-client-protocol-schema) defines exactly four canonical kinds: allow_once | allow_always | reject_once | reject_always.

• v1 rejects unknown kinds at deserialization — the observed failure: Zed's strict serde refused allow_tool/allow_server, the dialog never produced a selected outcome, and the approval was silently denied (unknown permission outcome: "").
• v2 tolerates unknown kinds via an untagged Other(String) fallback, but the dialog's option lookup never matches Other, so those kinds still cannot work — and would become a future hazard if whale ever negotiates v2.

Changes

• Typed kind (types.go): Kind string → PermissionOptionKind + constants KindAllowOnce/KindAllowAlways/KindRejectOnce/KindRejectAlways + Valid() + String(), matching the schema enum.
• Send-path guard (adapter.go): NewACPApprovalFunc denies loudly via invalidPermissionOptionKind instead of sending a payload the client would reject.
• Options: inline once/always/reject options now use the typed constants (wire values unchanged).

Validation

• go build ./..., go vet, gofmt clean.
• -race on internal/acp.
• Tests: serialize the real request_permission payload for every tool-name permutation and assert every kind is schema-valid; cross-check against a strict decoder mirroring the serde enum; Valid() guard; invalidPermissionOptionKind helper (nil, first-invalid, valid); decision-mapping downstream (once/always/reject/unknown/missing/cancelled/unknown-outcome/malformed); error envelope; transport close; 32 concurrent sessions (-race clean).

Review guidance

• types.go PermissionOptionKind + Valid(): the four canonical kinds are the single source of truth; any new kind must first exist in the schema crate (v2's Other(String) fallback is an escape hatch, not a license to invent kinds).
• adapter.go guard + invalidPermissionOptionKind: fail-loud deny before the wire, replacing the old silent denial.

User-visible impact

• Prevents MCP approvals silently denied (tool result approval_denied, turn canceled) when the client rejects unserializable kinds — that failure can kill a session.
• On main, current options were already schema-valid; this closes the systemic hole so an invalid kind can never reach the wire again.

Breaking changes

None. Wire values unchanged (allow_once/allow_always/reject_once); typed field marshals identically to the previous string.

Reproduction

1. Failure mode: request_permission with kind: "allow_tool" → Zed.log unknown variant 'allow_tool', expected one of 'allow_once', 'allow_always', 'reject_once', 'reject_always' → unknown permission outcome: "" — denying.
2. Regression: TestPermissionOptionKindsAreSchemaValid serializes every option permutation and asserts schema-valid kinds on the wire.

Developed with carefully directed, manually reviewed AI assistance.