Parent: #64227

Summary

Make elevatedDefault: full truthful: only advertise it when host auto-approved exec is actually possible, and surface precise blocked states when sandbox or runtime policy makes full access impossible.

Scope

• full means auto-approved host exec is actually available
• explicit permission-blocked states when sandbox/channel/runtime policy makes full impossible
• no second permission system

Acceptance

• GPT-5.4 stops re-asking for impossible permissions
• blocked states name the true constraint
• default permission behavior stays backward-compatible outside the stricter reporting changes