buzz-acp: make session/request_permission auto-response configurable (deny-by-default option)

## Context

I'm embedding Buzz as a collaboration/audit layer in a supervised personal-automation setup, where agents connected over ACP must run fail-closed: a permission request that nobody explicitly approves should be rejected, not granted.

## Current behavior (v0.5.2)

- `crates/buzz-acp/src/config.rs` defaults `BUZZ_ACP_PERMISSION_MODE` to `bypass-permissions`.
- `handle_permission_request` in `crates/buzz-acp/src/acp.rs` auto-approves the `allow_once` option when one exists, and falls back to `reject_once` only when no allow option is present.

So a stock deployment connected to a production environment will silently grant agent permission requests. For my use case that behavior is disqualifying without a patch — and the patch looks small, since the reject path already exists.

## Request

A configurable auto-response for `session/request_permission` — e.g. extend the existing env var surface with something like `BUZZ_ACP_PERMISSION_AUTO_RESPONSE=allow-once|reject-once` (or an equivalent config key), so operators can choose deny-by-default without maintaining a fork. The default can stay as-is for backward compatibility.

Related: #2884 touches the same surface from the other direction (exposing more of the adapter's native permission modes); this request is about what buzz-acp itself does when asked, independent of adapter mode.

Happy to submit a PR if the direction is acceptable — the change looks contained to which branch of `handle_permission_request` wins, plus config plumbing and a test asserting `allow_once` is never auto-selected in deny mode.