feat(acp): integrate human permission decisions

[anhle128]

Ports the interactive permission-policy work from block#5106 onto the fork's current main without importing unrelated upstream commits.

What this fixes:

• ask policy leaves permission requests actionable for a human in Buzz.
• Buzz renders Allow/Deny choices and sends the selected permission_decision back to the ACP harness.
• Global and per-agent policies support ask, allow, and reject.
• Pending requests fail closed on timeout, cancellation, or disconnect.

Fork compatibility work:

• Fixed upstream formatting/clippy failures.
• Split over-limit Rust/TypeScript files without changing behavior or raising file-size limits.
• Added a focused E2E assertion for the human Allow/Deny path.

Verification:

• just ci
• Focused Playwright permission-decision E2E
• GitNexus compare against origin/main (CRITICAL expected: central ACP permission path)