feat(agent): enforce readonly execution mode

[zaixiaziyang]

Summary

• Add Chat, Read-only Agent, and Agent permission modes across the desktop GUI, WebUI, and Gateway normalization.
• Apply one allowlist to both model-visible tool schemas and actual tool dispatch; unclassified tools default to denied.
• Make readonly runtime Memory read-only and disable TodoWrite, hooks, silent memory extraction, uploads, Skills mutation, Cron, SSH, Tunnel, MCP configuration writes, and dynamic MCP tools.
• Force delegated agents to readonly mode, hide worktree and merge-back fields, and reject invalid batches before worktree creation.

Testing

• GUI settings, tool-policy, and subagent tests: 69 passed
• WebUI settings tests: 27 passed; full WebUI frontend suite passed
• GUI and WebUI production builds
• Biome diagnostics on changed files and git diff --check

Notes

The full GUI suite has five unrelated Windows baseline failures: one LF-only builtin-skill assertion and four shell parsing tests that fall through to the Tauri mock. The affected readonly tests pass. A Go toolchain was not available locally, so the small Gateway handler normalization test is left to CI.