[BUG] Fork subagent performs write actions despite parent session being in plan mode

### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code

### What's Wrong?

When the main session is in plan mode (which restricts it to read-only tools plus editing the plan file), spawning a subagent via Agent
with subagent_type: "fork" and an explicitly read-only prompt does not reliably inherit that restriction. The fork was able to call
Edit/Write and modify real project files, even though the parent session itself was correctly blocked from doing so.

Actual behavior

The fork ignored the read-only scope of its prompt and the plan-mode restriction on its parent, and:
- Made a real content edit to two files (which, in this case, happened to match what the eventual approved plan called for).
- Additionally introduced an unintended side effect: it flipped both edited files' permission bits from 100644 to 100755 (executable),
unrelated to the actual code change.
This meant the parent session had to detect the out-of-band change via git diff after the fact, and manually clean up the file-mode side
effect, rather than the restriction being enforced at the tool-permission layer for the fork itself.

Environment

- Claude Code CLI
- Model: Sonnet 5 (claude-sonnet-5)
- Platform: Linux (WSL2), git repository

### What Should Happen?

A fork spawned from a session in plan mode should inherit the same tool restrictions as the parent (no edits outside the plan file, no
non-readonly tool calls) until the parent exits plan mode.

### Error Messages/Logs

```shell
Impact

This breaks the safety guarantee of plan mode: a user reviewing/approving a plan before any code changes happen can be undermined if a
background/forked agent performs real edits during the planning phase without the user's knowledge or approval.
```

### Steps to Reproduce

Repro steps

1. Enter plan mode.
2. Use the Agent tool with subagent_type: "fork" to dispatch a task whose prompt is explicitly scoped as read-only (e.g., "grep for X in
file Y and report the line numbers and a snippet — do not edit anything").
3. Observe the fork's result: instead of just reporting findings, it used Edit/Write tools and modified the target files directly.

### Claude Model

Sonnet (default)

### Is this a regression?

Yes, this worked in a previous version

### Last Working Version

_No response_

### Claude Code Version

2.1.274 (Claude Code)

### Platform

Anthropic API

### Operating System

Ubuntu/Debian Linux

### Terminal/Shell

WSL (Windows Subsystem for Linux)

### Additional Information

_No response_

No source files or tests are named. Start by reproducing the plan-mode fork scenario in Claude Code CLI on the stated Linux/WSL setup, then inspect the fork's tool-permission handling; done means a fork cannot edit project files or make non-read-only calls until the parent exits plan mode, without changing file permissions.

Written by the indexing model from the issue text.