Add deterministic permissions and approval policy for agent tools

[michaelmwu]

Parent: #257

Goal

Implement deterministic permission controls for agent tool calls. The LLM may propose actions, but backend policy must authorize all execution.

Scope

• Resolve identity from Discord context:
  • Discord user ID
  • internal user ID
  • organization/workspace/team
  • channel-derived project context where applicable
• Define capability scopes such as:
  • task:create
  • task:update
  • task:assign
  • task:delete
  • project:read
  • project:write
  • github:issue:create
  • github:pr:create
  • deploy:request
  • deploy:execute
• Add tool-level authorization before execution.
• Add resource-level checks for task/project/org access.
• Add risk-based behavior:
  • low: execute immediately when authorized
  • medium: require user confirmation
  • high: require confirmation plus audit reason
  • critical: require approval from another authorized human

Important constraint

The model must never decide whether the user is allowed to do something. It can classify intent and propose a plan, but policy code must decide.

Acceptance criteria

• Every tool call passes through a policy check before execution.
• Permissions are capability-based, not a single broad "AI admin" role.
• Resource-level authorization is enforced for task/project operations.
• Denied actions produce clear user-facing reasons.
• Policy decisions are auditable.

[michaelmwu]

Implemented in PR #264. Agent tool calls now go through deterministic PolicyEngine checks, role-derived scopes, tenant checks, task ownership/resource checks, denied user-facing reasons, and audit metadata from the backend agent endpoints.