`always_allow` permission policy not honored for `agent.custom_tool_use` MCP tool calls (Managed Agents beta)

## Bug description

MCP tool calls in Managed Agent sessions are randomly denied with "Permission to use [tool] has been denied" despite the agent being configured with `always_allow` on both `default_config` and explicit per-tool `configs`. The denial correlates **100%** with calls being classified as `agent.custom_tool_use` events. Calls classified as `agent.mcp_tool_use` succeed. The classification is assigned server-side, per session, non-deterministically.

This looks like a migration side-effect: the platform appears to be renaming `agent.mcp_tool_use` → `agent.custom_tool_use`, but the `always_allow` enforcement is only applied to the old event type.

## Reproduction

No deterministic repro steps — the failure is server-side and random per session. Observable pattern:

1. Create a Managed Agent with `mcp_toolset` configured as below.
2. Start sessions in a loop. Approximately half land on `agent.custom_tool_use` and all MCP calls are denied; the rest land on `agent.mcp_tool_use` and succeed.
3. The same session ID that fails one minute succeeds on a fresh session a few minutes later.

## Agent config

```js
// mcp_toolset entry (applied via client.beta.agents.update)
{
type: 'mcp_toolset',
mcp_server_name: 'microsoft-365',
default_config: {
enabled: true,
permission_policy: { type: 'always_allow' },
},
configs: [
{ name: 'sharepoint_search', enabled: true, permission_policy: { type: 'always_allow' } },
{ name: 'sharepoint_folder_search', enabled: true, permission_policy: { type: 'always_allow' } },
{ name: 'read_resource', enabled: true, permission_policy: { type: 'always_allow' } },
{ name: 'sharepoint_list_sites', enabled: true, permission_policy: { type: 'always_allow' } },
],
}
```

## Evidence

Correlation across last 100 sessions (M365 tools: `sharepoint_search`, `sharepoint_folder_search`, `read_resource`, `sharepoint_list_sites`):

| Event type | ok | denied |
|---|---|---|
| `agent.custom_tool_use` | **0** | **65** |
| `agent.mcp_tool_use` | works | 0 |

Counterexamples: **NONE.** 100% correlation.

**Denied session:** `sesn_01BSJRnDAib71EjqmbaWD2gB` (2026-06-23T02:24Z) — all 3 `sharepoint_search` calls `is_error=true`.
**Working session:** `sesn_01LwKmvr22wtBssXEyvPPDjE` (2026-06-23T02:21Z) — same agent, same vault, same config, 3 min earlier.

The denied session's **embedded agent snapshot** (`session.agent`) confirms the correct v10 config was in place — the session ran with `always_allow` set and was still denied.

## What we ruled out

| Hypothesis | Ruled out |
|---|---|
| Missing `default_config` | Present, confirmed in session snapshot |
| Missing per-tool `configs` | All four M365 tools present |
| Agent version not propagated | Denied session snapshot = v10 |
| Vault credential invalid | Same vault works and fails within minutes |
| SDK version | Same `@anthropic-ai/sdk` v0.96.0 produces both event types; v0.96→0.105 changelog has no relevant entry |
| Within-session transience | All calls in a denied session are `custom_tool_use` — within-session retry is useless |

## Environment

- SDK: `@anthropic-ai/sdk` v0.96.0
- Node 18, Azure Functions (Windows Consumption)
- Affected MCP servers: `microsoft-365` and `fathom` (same pattern on both)
- Agents: two separate agents in the same environment, both affected

## Expected behaviour

`always_allow` on `default_config` (and explicit `configs`) should prevent denials regardless of which internal event type the platform uses to classify the tool call.

## Actual behaviour

Calls classified as `agent.custom_tool_use` are denied. Calls classified as `agent.mcp_tool_use` are allowed. Config is identical.

## Ask

Either fix `always_allow` enforcement for `agent.custom_tool_use` to match `agent.mcp_tool_use`, or document a config/beta-header/SDK option that consistently routes sessions to the working code path.