fix(permissions): validate network access flow

crates/infrastructure/src/runtime_permission.rs

@@ -7,8 +7,7 @@ use async_trait::async_trait;
 use domain::ports::{RuntimeError, RuntimePermissionProbe};
 use domain::{AgentId, Project, RuntimePermissionSnapshot};
 
-/// Conservative probe used when IdeA cannot inspect or pilot runtime network
-/// permissions.
+/// Passive probe used when IdeA has no active runtime network telemetry.
 #[derive(Debug, Clone, Default)]
 pub struct ReadOnlyRuntimePermissionProbe;
 
@@ -19,6 +18,6 @@ impl RuntimePermissionProbe for ReadOnlyRuntimePermissionProbe {
         _project: &Project,
         _agent_id: AgentId,
     ) -> Result<RuntimePermissionSnapshot, RuntimeError> {
-        Ok(RuntimePermissionSnapshot::locked_uninspectable())
+        Ok(RuntimePermissionSnapshot::unobserved())
     }
 }