[FEATURE]: Permission action for session utilities (session_move / session_rename)

Feature hasn't been suggested before.

• I have verified this feature I'm about to request hasn't been suggested before.

Describe the enhancement you want to request

Problem: session_move and session_rename do not request a permission action. The session docs state it directly: "These utilities do not request a built-in permission action." No permission profile can gate them: a restricted subagent with deny rules on everything else can still move its own session, or any other session by ID, to any directory.

Moving a session is not cosmetic here. The session location defines which paths count as internal, so a session that moves itself back to the parent checkout undoes its path restrictions.

Request: a permission action for the session utilities, so agent permission profiles can allow, ask, or deny session_move and session_rename like any other tool.

Start by locating the session_move and session_rename utilities, the permission-action definitions, and their existing tests. Trace how other tools support allow, ask, and deny decisions, then add equivalent coverage for both session utilities; done means profiles can explicitly allow, prompt for, or deny each action.