run: headless session denies are not applied to subagent or reused sessions #168

Context

aictrl run applies its headless denies (question, plan_enter, plan_exit) only as the permission of the session it creates (cli/cmd/run.ts, sdk.session.create(... permission: rules)). #162 (for #147) makes the model request honour session-level denies, but some sessions in a headless run never get those rules:

1. Subagent sessions. TaskTool creates the child session (tool/task.ts, Session.create) with only the todowrite/todoread/task denies. The parent session's rules are not inherited.
2. Reused sessions. With --continue or --session, run reuses an existing session as is. With --fork, it forks one, and the fork does not get rules either.

Impact

• Built-in subagents (general, explore) are unaffected, because the agent defaults already deny question/plan_enter/plan_exit.
• A custom subagent, or a user permission config that allows question (this is merged into every agent), gets question offered and evaluated as allow/ask inside a headless run. A headless client has nobody to answer it.
• A continued, resumed or forked headless session has none of the headless denies.

Proposal

• Decide whether child sessions should inherit the parent session's ruleset, either all of it or only * denies, and apply that in TaskTool (e.g. PermissionNext.merge(parent.permission ?? [], taskDenies)).
• In run, apply rules to reused and forked sessions too, e.g. with Session.setPermission / the SDK equivalent, merged with whatever rules the session already has.

Acceptance

• A subagent spawned from a headless run session is not offered question/plan_enter/plan_exit, even when its agent allows them (regression test).
• run --continue, --session and --fork sessions carry the headless denies (regression test).
• Interactive sessions are unchanged.

Found in the review of #162 (finding: "Subagent sessions don't inherit parent session denies").