Task subagents inherit parent session denies that later rules superseded

Describe the bug

deriveSubagentSessionPermission copies every parent-session deny rule into a task subagent's session, ignoring rule order. Session permission rules are append-only and evaluated last-match-wins, so a parent whose history is:

[
  { "permission": "bash", "pattern": "*", "action": "deny" },
  { "permission": "bash", "pattern": "*", "action": "allow" }
]

is effectively allowed to run bash — but every new task subagent it spawns receives only the stale bash deny. The parent can work; all of its future children are permanently denied, even when the subagent's own agent policy allows bash.

This bites any client that implements a plan-style restriction by appending session denies and later restores access by appending allows (PATCH is append-only; there is no rule-removal API). Once a session has ever been restricted, it can never again delegate mutating work.

Steps to reproduce

On 1.18.22 (also present on current dev):

1. Create a session.
2. PATCH /session/{id} with permission: [{bash,*,deny}].
3. PATCH /session/{id} with permission: [{bash,*,deny},{bash,*,allow}] (append-only restore).
4. Confirm the parent itself can run bash.
5. Prompt the parent to delegate a bash command via the task tool.
6. Inspect the child session's permission: it contains {bash,*,deny}. The child's bash calls are denied.

Expected behavior

Only denies that are still part of the parent's effective ceiling should be inherited. A deny that a later rule supersedes for the same permission and pattern is no longer the parent's effective action and should not pin the child.

Environment

• opencode 1.18.22, macOS arm64, verified unchanged at dev HEAD
• packages/opencode/src/agent/subagent-permissions.ts (rule.action === "deny" filter keeps every deny regardless of later rules)