fix(session): merge per-call tool rules into session permission

[remorses]

Issue for this PR

Closes #30527

Type of change

• Bug fix

What does this PR do?

When a parent session has an external_directory allow rule (or any other session-level rule beyond plain tool denies), dispatching a subtask through the task tool produces a child session whose permission ruleset is missing those inherited rules. The subagent then asks for permission to read a directory the parent had already approved.

The child session is in fact created correctly. deriveSubagentSessionPermission produces the right rules and sessions.create persists them. The damage happens immediately afterwards in SessionPrompt.prompt: it sees tools: { task: false, todowrite: false } from the task tool, builds [task deny, todowrite deny], and writes that to session.permission via setPermission. setPermission replaces the row, so the inherited external_directory allow is dropped.

Fix is a one-line semantic change: merge the per-call tool rules on top of the existing session.permission instead of replacing it. Permission.evaluate uses findLast, so the appended tool denies still take effect for their targets, while previously-set rules survive.

How did you verify your code works?

• Reproduced the bug end-to-end against a local server via the SDK before and after the fix.
• Two new unit tests on SessionPrompt.prompt (with and without tools) pin the merge/preserve contract.
• One new integration test runs the real task tool path through prompt.loop with a subtask part and asserts the child session inherits the parent's external_directory allow. All three fail on dev without the change and pass with it.
• bun typecheck is clean.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

[github-actions]

The following comment was made by an LLM, it may be inaccurate:

Based on my search, I found one related PR that addresses a similar issue:

PR #30288: fix(opencode): inherit MCP tool allow permissions in subagent sessions

• fix(opencode): inherit MCP tool allow permissions in subagent sessions #30288
• This PR is directly related as it also deals with inheriting tool allow permissions in subagent sessions, which is the core issue your PR (30529) addresses. While it focuses on MCP tools specifically, both PRs tackle the inheritance problem where child sessions lose parent session permissions.

This appears to be the most relevant match, as both PRs address the broader problem of subagent sessions not properly inheriting parent session permission rules. The difference is scope: your PR provides a general fix to the merge logic in SessionPrompt.prompt, while #30288 may be more specific to MCP tool permissions.