Legacy agent `tools` config overrides user `permission` rules in 1.18.26

Description

Since 1.18.26, the deprecated per-agent tools map is converted into permission rules, and those derived rules land in the agent ruleset after the user's global permission config. Permission.evaluate is last-match-wins, so a "*": false entry in tools becomes a "*": "deny" rule that silently overrides every user-defined allow (e.g. external_directory allows for specific directories).

This makes agents configured the old way (tools allowlist) unable to read any external directory unless the user duplicates the allow at the agent permission level. Worked fine in 1.18.25.

OpenCode version

1.18.26

Steps to reproduce

1. Config:

{
  "permission": {
    "external_directory": { "/tmp/**": "allow" }
  },
  "agent": {
    "testagent": { "tools": { "*": false, "read": true } }
  }
}

2. Run opencode debug agent testagent

Actual ruleset (abridged) — the tools-derived deny-all sits after the user allow:

... {"permission": "external_directory", "action": "allow", "pattern": "/tmp/**"}  <- user rule, now dead
{"permission": "*", "action": "deny", "pattern": "*"}                              <- derived from tools
{"permission": "read", "action": "allow", "pattern": "*"}
...

3. Any read of a /tmp file by that agent gets denied.

Expected: rules derived from the deprecated tools map should rank below the user's explicit permission config.

Operating System

Windows 11

Originally reported to a downstream project (stablyai/orca#18209) because it looked Orca-specific at first glance, but it reproduces with plain opencode and no Orca involved.