fix(cli): deny subagent permission prompts

[noobezlol]

Fixes #11903

Summary

• mark subagent permission asks as non-interactive
• make non-interactive permission asks fail immediately with PermissionDeniedError instead of queuing a prompt
• add regression coverage that a subagent bash: ask request leaves no pending permission ask

Tests run

• bun install
• bun test ./test/kilocode/session-prompt-permission-refresh.test.ts -t "subagent permission asks fail"
• bun run typecheck from packages/opencode
• bun run script/check-opencode-annotations.ts
• git diff --check

Notes / risk

• Running the whole session-prompt-permission-refresh.test.ts file on this Windows D-drive sparse checkout timed out in the pre-existing active tool calls use permissions changed after model streaming starts test after 5s; the new regression passed when run by name.
• Behavior change is limited to permission asks that would otherwise wait for a non-interactive subagent.

[marius-kilocode]

@noobezlol this looks good, did you test it?

[marius-kilocode]

Superseded by #11923