feat(rovodev): add permissions adapter (~/.rovodev/config.yml toolPermissions)

[dyoshikawa]

Summary

Adds a rovodev permissions adapter that writes the toolPermissions section into the global ~/.rovodev/config.yml. rovodev was already a registered target for rules/mcp/skills/subagents but had no permissions adapter.

The adapter is global-only (mirroring the existing rovodev-mcp adapter) and merges into config.yml, preserving every other top-level key (agent, sessions, mcp, etc.). The file is never deleted because it holds all of the user's Rovo Dev settings.

Closes #1885

Evidence (upstream docs)

• Settings / config.yml top-level keys: https://support.atlassian.com/rovo/docs/manage-rovo-dev-cli-settings/
• toolPermissions schema (allow/ask/deny levels, per-tool keys, bash.default + bash.commands[], allowedExternalPaths): https://support.atlassian.com/rovo/docs/use-tools-in-rovo-dev-cli/

Rovo Dev's three permission levels (allow/ask/deny) are an exact 1:1 with rulesync's canonical action enum (src/types/permissions.ts), so action values pass through verbatim.

Canonical → Rovo Dev mapping decisions

• bash: catch-all * pattern → bash.default; every other pattern → a bash.commands[] entry { command: <pattern as regex>, permission }. Rovo Dev matches commands as regexes, so bash patterns are emitted verbatim.
• read → the inspection tools open_files, expand_code_chunks, expand_folder, grep.
• edit / write → the mutation tools find_and_replace_code, create_file, delete_file, move_file.
• These Rovo Dev per-tool keys hold a single level (no per-pattern rules), so only the catch-all * of each category sets the level. Non-catch-all allow paths in those categories are surfaced as allowedExternalPaths so explicit grants are not dropped; non-allow non-catch-all rules cannot be expressed per-path and are skipped with a logger.warn.
• Categories without a clean Rovo Dev target (e.g. webfetch) are skipped with a logger.warn rather than invented.
• Import reverses these mappings: bash.default/bash.commands → bash; per-tool keys → read/edit; allowedExternalPaths → read allow rules.

Files changed

• src/constants/rovodev-paths.ts — add ROVODEV_CONFIG_FILE_NAME = "config.yml".
• src/features/permissions/rovodev-permissions.ts — new RovodevPermissions adapter (global-only YAML, merge-preserving, never deletable).
• src/features/permissions/permissions-processor.ts — register rovodev (supportsProject: false, supportsGlobal: true, supportsImport: true).
• src/features/permissions/rovodev-permissions.test.ts — new unit tests (map/merge/round-trip, YAML-merge-preserves-other-keys, non-global throw).
• src/features/permissions/permissions-processor.test.ts — add rovodev to the global-targets assertion.
• src/e2e/e2e-permissions.spec.ts — new --global generate test asserting toolPermissions is written into ~/.rovodev/config.yml and unrelated keys are preserved.
• README.md, docs/reference/supported-tools.md, docs/reference/file-formats.md — set permissions for Rovodev (global-only 🌏) and document the mapping; skills/rulesync/* auto-synced via scripts/sync-skill-docs.ts.

Notes / deferred

• No rules-processor.ts additionalConvention change is needed — permissions are wired through the permissions-processor factory map, not additionalConvention.
• pnpm dev gitignore produced only unrelated drift (a GEMINI.md reorder); reverted. ~/.rovodev/config.yml is a global path and does not appear in the project .gitignore.
• The import round-trip is covered as a unit test rather than e2e: the e2e runImport helper does not pass --global, and global-only permissions tools (Warp, Antigravity CLI) follow the same convention of unit-level import coverage.

Verification

pnpm cicheck is fully green:

• Code: lint (oxlint), typecheck (tsgo), and all 6452 unit tests pass.
• Content: sync-skill-docs in sync, cspell 0 issues, secretlint clean.
• E2E permissions spec (src/e2e/e2e-permissions.spec.ts): 41/41 pass, including the new Rovodev --global generate test.

🤖 Generated with Claude Code

[dyoshikawa]

@dyoshikawa Thank you!