fix: Permission gate (requestToolPermission) is defined but never called — all tool executions bypass permission checks (#663)

## Summary
This PR was generated by [Corridor](https://corridor.dev) to fix:

- Permission gate (requestToolPermission) is defined but never called —
all tool executions bypass permission checks

## Changes
To close the missing authorization gap (CWE-862), the fix wires a call
to requestToolPermission() into the tool execution path inside
handleAIMessage(), awaiting a user decision before moving from the
in_progress state. Depending on the decision, the tool call is rejected
(marked failed, updated to the client, removed from active calls, and
the prompt/stream aborted), cancelled (similar cleanup and abort), or
allowed to proceed as before; the existing allow_always/reject_always
caching is preserved via the session’s permissionDecisions. The change
is narrowly scoped to the for loop in handleAIMessage() and does not
alter interfaces, semantics, or other code paths.

---
Generated by Corridor

Co-authored-by: corridor-security[bot] <203152403+corridor-security[bot]@users.noreply.github.com>