fix(permissions): stop tlive from changing what CC asks, and close #64

[y49]

Six baseline violations in the permission path, plus #64. Every fix here came out
of measuring the real thing against Claude Code's own behaviour rather than
reading our own comments, and several of those comments turned out to be wrong.

The contract

Installing tlive must not change which prompts the user sees, nor add
messages the no-hook baseline never sends. Each item below restores that.

What was broken

Read/Glob/Grep were auto-allowed unconditionally. The justification in the
code was that CC doesn't prompt for them anyway and our * matcher would add
friction. That reasoning is wrong: PermissionRequest fires only when CC is
about to show a dialog, so the hook never sees an ungated Read — there is no
friction to suppress, and every allow there deleted a prompt the user would
have seen (a Read outside the working directory, for instance). Now opt-in
behind approvals.autoApprove, default off. /safe off also stopped silently
switching read-only allow on for someone who never opted into any
auto-approval.

MCP approvals never arrived. The "Always allow <tool>" button carried the
tool name in its callback payload. Telegram caps callback_data at 64 bytes and
rejects the whole card when any button is over — which every tool name longer
than 17 characters was, i.e. every mcp__<server>__<tool>. Measured 79 bytes for
mcp__codegraph__codegraph_status. The request then hung with no answer surface
until the caller died, and nothing was logged, because the send was
fire-and-forget with .catch(() => undefined). Payload is now requestId-only
(46 bytes, always safe) with the name resolved from the pending request, and
failed sends are logged as permission.card.undelivered.

A bare, un-answerable "answer in the terminal" text was pushed in full mode.
Reaching that path in full mode means tlive saw the request and handed it back
(sub-agent pass-through, policy allow, no answer surface) — and "handed back"
means "behave as if tlive were not installed". It also cannot be attributed: CC's
Notification input carries neither agent_id nor tool_name, and its
session_id is the main session's even when the dialog belongs to a sub-agent.
notify mode still sends it, since there it is the only signal a dialog is
waiting.

Observational hooks could add 4s to any tool call. They run synchronously and
post-tool-use fires on every call, so a slow daemon taxed the terminal
directly. Capped at 1.5s; a healthy local socket round trip is sub-millisecond.

/safe had two hand-written copies of its wording and the "off" text
promised a read-only exception the new default no longer grants.

#64 — attaching during output lost bytes. shadow.write(data) is
asynchronous while the broadcast to sockets is synchronous, so a snapshot built
at attach time could end at offset P while the client's live bytes start at
Q > P, silently dropping everything between; or be empty and dropped by the
length > 0 guard, leaving the tab blank. Fixed with a parse barrier plus
holding that client's frames until its snapshot is on the wire — neither works
alone, since the barrier by itself just moves the gap. The regression test
attaches mid-burst and asserts an unbroken run of markers; without the barrier it
fails immediately (measured a 223-line hole, 7038 → 7262).

Comment corrections

These were load-bearing and wrong:

• CC builds every hook's base input with the main session id and puts
  sub-agent identity only in agent_id. So sessionId discriminates nothing
  between a session and its sub-agents — only matchAgent does. hasPendingFor
  and LocalPrompts' single slot are proxies that cannot be made exact, and
  now say so.
• "A held hook leaves CC with no local dialog" is false for the main session:
  measured 5/5 holds produced a permission_prompt 6.0s in (spread 16ms), and
  four were answered at the keyboard mid-hold. The 6s delay is the
  notification's own, gated on the user having been idle — which is why its
  absence had looked like the dialog's absence.

Verification

tsc clean, 670 tests, 70 files. Each fix was driven from a failing test first;
the MCP button and the #64 gap both reproduce deterministically without the fix.

Sub-agent behaviour is deliberately left alone here — it depends on an
asymmetry filed upstream as anthropics/claude-code#82150 (the hook is awaited
before the dialog is built for background sub-agents, while the main session runs
both in parallel), and a design that assumes either answer would need reworking
if that changes.

Closes #64