NDJSON session_start.permissions omits config and session rules #212

Problem

EVENTS.md says that session_start.permissions is "the fully resolved permission ruleset for the session (merge of agent + session rules)". In fact run.ts emits agentInfo.permission, which is the agent's own rules only.

In the benchmark, a config with permission.bash deny or ask rules produced a session_start.permissions that did not list those rules, on 0.4.8 and on the 0.5.0 candidate. On the candidate it is [] for the default agent. Consumers that audit what a run was allowed to do from this event get the wrong answer.

The tool-call path has used the merged agent + session ruleset since #162 (session/llm.ts resolveTools and PermissionNext). Only the event is out of step.

Proposal

Emit the same merged ruleset that tool calls are checked against: agent + config + session, in evaluation order. Alternatively, if that can't be computed cheaply at session_start, change EVENTS.md to say what the field actually contains. The first option is preferred.

Acceptance criteria

• A run with permission.bash: { "rm *": "deny" } in config lists that rule in session_start.permissions.
• The order matches evaluation order (the last matching rule wins), and EVENTS.md says so.