RFC: Permission query API and launch-time consent for pre-realm permissions

Raised in: #448 (closed as not planned)
Not Release 2.

Description

A product reads the remote permissions resolved for its realm without prompting and without a reload, and consents to the pre-realm set once at launch rather than per capability mid-session.

Motivation

#444 resolves WebRTC before the realm exists, so a grant given mid-session only applies on the next load. #446 removes that cost for trusted labels only; every other product still gets a prompt it cannot act on until the web view reloads. A product also has no way to ask what it holds — RFC 0002 unresolved question 2.

Requirements

• The query answers from settled state — never prompts, never triggers a reload.
• A stored user denial wins; nothing here creates a grant.
• Pre-realm decisions stay enforced in-realm against a value fixed before the realm exists (#379 escapes).
• The manifest does not declare outbound permissions — trustedProducts is inbound only (#802).

Tasks

• RFC document body
• Implementation — rust-core
• Implementation — hosts
  • dotli
  • Desktop
  • iOS
  • Android
  • host-cli

Note: no RFC drafted yet.

No implementation file or test is named. Start by drafting the RFC document body, then review RFC 0002 question 2 and the referenced issues #444, #446, #379, and #802. Done requires the RFC plus coordinated rust-core and host implementations for dotli, Desktop, iOS, Android, and host-cli.