[FEATURE] Support individual skill permissions like CLI (Skill(name) patterns)

## Problem Statement

Claude Code CLI supports granular skill permissions via `settings.json`:

```json
{
"permissions": {
"allow": ["Skill(my-skill)", "Skill(ops-*)"],
"deny": ["Skill(deploy-*)"]
}
}
```

The Claude Agent SDK does not support this granularity. The SDK only allows enabling/disabling the `Skill` tool globally via `allowed_tools`:

```python
options = ClaudeAgentOptions(
allowed_tools=["Skill", "Read", "Grep"] # All skills or no skills
)
```

This creates a feature gap where CLI users have fine-grained control over which skills are available, but SDK users building custom agents cannot achieve the same level of control.

## Proposed Solution

Add support for individual skill permissions in the Agent SDK, matching the CLI behavior:

**Option A: Permission rules in SDK options**
```python
options = ClaudeAgentOptions(
permissions={
"allow": ["Skill(safe-reader)", "Skill(ops-*)"],
"deny": ["Skill(deploy-*)"]
}
)
```

**Option B: Skill-specific allowlist**
```python
options = ClaudeAgentOptions(
allowed_skills=["safe-reader", "ops-query-patterns"],
denied_skills=["deploy-*"]
)
```

## Use Case

Building an agent runtime that exposes different skills to different user roles:
- **Operators** should only access `ops-*` skills
- **Developers** can access all skills except `deploy-*`
- **Admins** have unrestricted access

With CLI, this is achievable via permission rules. With SDK, I must either:
1. Allow all skills (too permissive)
2. Deny all skills (too restrictive)
3. Implement custom hook-based filtering (complex workaround)

## Alternative Solutions / Workarounds

1. **Use hooks** to inspect and filter skill invocations at runtime - works but adds complexity
2. **Dynamically modify the skills directory** per request - fragile and not thread-safe
3. **Use MCP tools instead of skills** - MCP has full permission support but loses skill ergonomics

## Related Issues

- #528 - Support skills loading scope (related but focused on loading, not permissions)
- CLI issues that added skill permissions: anthropics/claude-code#10833, anthropics/claude-code#14154

## Additional Context

The `allowed-tools` frontmatter in SKILL.md also doesn't apply when using skills through the SDK (per documentation), further widening the CLI vs SDK gap.