[Bug] Plan-accept context clear leaks previous skill's disallowed-tools to fresh context

**Bug Description**
A skill's `disallowed-tools` leaks past the plan-accept context clear and disables those tools for the first turn of the fresh context.

Version: 2.1.220 (macOS, CLI)
Setting in play: "showClearContextOnPlanAccept": true

## What happens

A plugin skill that declares `disallowed-tools: Bash, NotebookEdit, Task, Agent, WebFetch, WebSearch` drafts a plan and calls `ExitPlanMode`. The user accepts, context is cleared (`SessionStart:clear`), and the plan is re-injected as a fresh user prompt. On the FIRST turn of that fresh context, the previous skill's `disallowed-tools` denylist is still applied: Bash, Agent, WebFetch and WebSearch are absent from the tool set. The restriction disappears on the next user message.

Concrete failure: the first thing needing Bash is another skill's `!`...`` preload, so the skill fails to load with

Shell command permission check failed for pattern "!`"/path/to/skills//../../scripts/read-config.sh"`": Permission to use Bash has been denied.

Note the message is the tool-level variant (no `with command ` clause), i.e. the whole Bash tool was denied, not the specific command. Bash is allowed blanket-wide in both user and project settings, and the skill carries the matching pre-approval pattern in `allowed-tools`.

## Transcript evidence (session 0e3bb974, 2026-07-26)

- 10:43:10 planning skill (own `disallowed-tools` incl. Bash) calls ExitPlanMode
- 10:57:05 plan accepted, SessionStart:clear fires, plan re-injected as a user prompt
- 10:57:10 model calls the build skill -> preload denied (message above)
- 10:57:10 deferred_tools_delta for that turn contains no Bash, no WebFetch, no WebSearch, no Agent
- 10:57:18 model runs ToolSearch("select:Bash,BashOutput,KillShell") -> returns only TaskOutput, TaskStop, so Bash was genuinely not in the registry
- 11:00:48 next user message -> deferred_tools_delta re-adds WebFetch + WebSearch, agent_listing_delta re-adds all agent types
- 11:00:53 same build skill loads fine, preload resolves normally

Reproduced in 4 sessions (2026-07-25 21:09, 23:47; 2026-07-26 08:03, 10:57), each preceded by SessionStart:clear.

## Expected

After the plan-accept context clear, the fresh context should start with the full, unrestricted tool set. The exited skill's `disallowed-tools` should not apply to it.

## Impact

Any post-plan flow whose first action needs a tool the planning skill denied fails immediately, with a message that points at the wrong culprit (it names the preload "pattern", suggesting a bad `allowed-tools` entry, while the real cause is the tool-level denial). Workaround: send any extra message before the first tool use, or set showClearContextOnPlanAccept: false.

**Environment Info**
- Platform: darwin
- Terminal: vscode
- Version: 2.1.220
- Feedback ID: 8304bd0d-ebb3-426e-8fac-dc4fa5943127

**Errors**
```json
[]
```

Reproduce the flow with showClearContextOnPlanAccept enabled: a skill calls ExitPlanMode, SessionStart:clear fires, and the plan is re-injected. Inspect how the previous skill's disallowed-tools state reaches the first fresh turn and how deferred_tools_delta is built; use ToolSearch to verify the available tools. Done means the fresh context starts with the full tool set, including Bash, WebFetch, WebSearch, and Agent.

Written by the indexing model from the issue text.