Regression: #2760 dropped permission context when loading legacy v1 session state (re-opens #2768)

## Summary

#2769 fixed #2768 ("ReActAgent legacy-state load silently drops permissionContext (downgrades to DEFAULT)") by forwarding the caller's `permCtx` to `LegacyStateLoader`. Commit 605978292 (#2760) rewrote `ReActAgent.loadOrCreateAgentStateForSlot(...)` and dropped that argument, calling the 3-arg `LegacyStateLoader.loadFromLegacySessionWithPresence(stateStore, userId, sessionId)` overload again — so the regression described in #2768 is live on `main` again.

## Impact

Same as #2768: any session that still has v1-era keys (`memory_messages` / `toolkit_activeGroups`) but no new-format `agent_state` — typically the first turn after a 1.x → 2.0 migration — gets its caller-configured permission mode (e.g. `BYPASS`) silently downgraded to `DEFAULT`.

## Repro / Fix

- **Repro**: seed v1 legacy keys, build an agent with `permissionContext(BYPASS)`, perform the first `call()` — the reconstructed state comes back `DEFAULT` instead of `BYPASS`.
- **Fix**: PR #2886 (passes `permCtx` to the 4-arg overload; includes an end-to-end regression test `ReActAgentLegacyPermissionContextTest` that fails on current `main` with `expected: but was: `).