Permission ask/deny patterns not enforced in serve (`-s`) sessions, v1.18.30

Repro (all in one session, Windows 11, opencode-ai 1.18.30, opencode.exe -s <id>):

1. Config permission.bash["*guard-test-marker*"] = "ask" → echo guard-test-marker runs clean, no prompt.
2. Same with "deny" → runs clean.
3. Config permission.write/edit["*canary\\denyt*"] = "deny" → write tool creates the file.
4. 50+ external_directory touches outside cwd across the session → never a prompt.
5. "shell" config key pointing at a logging shim → no invocations logged; commands unaffected.

Expected: ask prompts / denials. Actual: everything allowed, silently.
Related upstream: #7474 (subagent perms), #7063 (denied-yet-executed), #6396 (SDK ignores denies), #9853, #11272. Novel dimension here: enforcement absent for main AND subagent in serve transport, including file tools, not just bash.

Ask: is permission enforcement TUI-only by design? If so, docs should say so and serve should warn. If not, this is the repro.