feat(permissions): voie projection CLI (LP0→LP3) + checkpoint Codex/input

Jalon vert regroupant deux chantiers entrelacés dans le working tree,
indissociables au niveau fichier mais tous deux verts (cargo test
--workspace + tests frontend permissions au vert).

Permissions — voie « projection CLI » (advisory), complète :
- LP0 domaine pur : modèle PermissionSet/EffectivePermissions, resolve
  deny-wins + postures Allow<Ask<Deny (crates/domain/src/permission.rs).
- LP1 store : FsPermissionStore (.ideai/permissions.json).
- LP2 use cases : Get/Update project, Update agent override, Resolve.
- LP3 projecteurs Claude/Codex (settings.local.json / config.toml),
  câblage launch-path + PermissionProjectorRegistry, nettoyage des
  fichiers Replace orphelins au swap de profil (LP3-4), composition root
  + commandes Tauri, UI PermissionsPanel (projet + override agent).
- ports.rs : PermissionStore + FileSystem::remove_file (cleanup au swap).

Reste ouvert (hors scope, marqué dans le code) : LP4 enforcement OS
airtight (Landlock fichiers) + résumé de permissions injecté.

Inclut aussi le chantier Codex/input/sessions structurées en cours
(McpConfigStrategy, StructuredAdapter, gestion d'input) partageant les
mêmes fichiers (lifecycle.rs, commands.rs, dto.rs, state.rs).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

crates/application/src/lib.rs

@@ -20,6 +20,7 @@ pub mod health;
 pub mod layout;
 pub mod memory;
 pub mod orchestrator;
+pub mod permission;
 pub mod project;
 pub mod remote;
 pub mod skill;
@@ -29,14 +30,15 @@ pub mod window;
 
 pub use agent::{
     drain_with_readiness, reference_profile_id, reference_profiles, selectable_reference_profiles,
-    send_blocking, ChangeAgentProfile, ChangeAgentProfileInput, ChangeAgentProfileOutput, ConfigureProfiles,
-    ConfigureProfilesInput, ConfigureProfilesOutput, CreateAgentFromScratch, CreateAgentInput,
-    CreateAgentOutput, DeleteAgent, DeleteAgentInput, DeleteProfile, DeleteProfileInput,
-    DetectProfiles, DetectProfilesInput, DetectProfilesOutput, FirstRunState, FirstRunStateOutput,
-    HandoffProvider, InspectConversation, InspectConversationInput, InspectConversationOutput,
-    LaunchAgent, LaunchAgentInput, LaunchAgentOutput, ListAgents, ListAgentsInput,
-    ListAgentsOutput, ListProfiles, ListProfilesOutput, ListResumableAgents,
-    ListResumableAgentsInput, ListResumableAgentsOutput, McpRuntime, ProfileAvailability,
+    send_blocking, ChangeAgentProfile, ChangeAgentProfileInput, ChangeAgentProfileOutput,
+    ConfigureProfiles, ConfigureProfilesInput, ConfigureProfilesOutput, CreateAgentFromScratch,
+    CreateAgentInput, CreateAgentOutput, DeleteAgent, DeleteAgentInput, DeleteProfile,
+    DeleteProfileInput, DetectProfiles, DetectProfilesInput, DetectProfilesOutput, FirstRunState,
+    FirstRunStateOutput, HandoffProvider, InspectConversation, InspectConversationInput,
+    InspectConversationOutput, LaunchAgent, LaunchAgentInput, LaunchAgentOutput, ListAgents,
+    ListAgentsInput, ListAgentsOutput, ListProfiles, ListProfilesOutput, ListResumableAgents,
+    ListResumableAgentsInput, ListResumableAgentsOutput, McpRuntime, PermissionProjectorRegistry,
+    ProfileAvailability,
     ProviderSessionProvider, ReadAgentContext, ReadAgentContextInput, ReadAgentContextOutput,
     ReferenceProfiles, ReferenceProfilesOutput, ResumableAgent, SaveProfile, SaveProfileInput,
     SaveProfileOutput, StructuredSessionDescriptor, UpdateAgentContext, UpdateAgentContextInput,
@@ -77,6 +79,12 @@ pub use memory::{
 pub use orchestrator::{
     McpRuntimeProvider, OrchestratorOutcome, OrchestratorService, RecordTurnProvider,
 };
+pub use permission::{
+    GetProjectPermissions, GetProjectPermissionsInput, GetProjectPermissionsOutput,
+    ResolveAgentPermissions, ResolveAgentPermissionsInput, ResolveAgentPermissionsOutput,
+    UpdateAgentPermissions, UpdateAgentPermissionsInput, UpdateProjectPermissions,
+    UpdateProjectPermissionsInput,
+};
 pub use project::{
     CloseProject, CloseProjectInput, CloseProjectOutput, CloseTab, CloseTabInput, CreateProject,
     CreateProjectInput, CreateProjectOutput, ListProjects, ListProjectsOutput, OpenProject,