fix(core): custom agent frontmatter permission adds to defaults instead of replacing them

The permissive default is documented (permissions.mdx: "Most permissions default to allow"). What is not: an agent frontmatter permission ADDS to the defaults instead of replacing them (agent.ts:293 additive merge; Permission.merge = rulesets.flat(), permission/index.ts:200-202). So a partial agent allowlist closes NOTHING unless the author knows to put "*": deny first (evaluate = findLast, last match wins — wildcard.ts:8 *→.*).

Repro (v1.18.29, Linux)

1. subagent with bash allowlist, no *: deny 2. run stat outside the worktree — executes; log: evaluated permission=bash pattern="stat ..." action.permission=* action.action=allow (catch-all rule). 3. with "*": deny as first bash rule the agent should lock (grep allow still passes — code-verified via findLast + insertion order, not runtime-tested).

Risk

A "read-only" agent runs everything. Non-FILE-aware commands (ls/stat) bypass external_directory too (scan.dirs unfed, shell.ts:378-414).

Proposed fix

If agent frontmatter defines permission, merge by replacement — or inject implicit *: deny for subagents. Minimum: document that every allowlist must start with "*": deny.

Verified to dev@57ef382843. Searched "permission allowlist", "agent default allow" — no duplicate found.