Fix Build tool recovery after Plan mode

[leoncheng57]

Closes #15

Summary

• replace persistent legacy prompt_async.tools overrides with append-only session policy activation before each prompt
• restore Build from the resolved /agent policy with edit/write/apply_patch alias handling and exact-suffix idempotence
• serialize the entire policy-activation + prompt_async critical section per directory/session
• model upstream persistence and PATCH append behavior in E2E, including same-session Plan -> Build, Build -> Plan, direct Build, legacy-session recovery, concurrent opposite modes, and activation failure recovery

Security analysis

• Plan only appends deny rules for discovered non-read tools; it never grants permissions
• Build contains no hard-coded allow path: it projects the resolved Build agent wildcard and tool-specific rules onto each discovered tool in source order, preserving last-match-wins semantics
• recovery restores configured bash:*:ask, rm -rf *:deny, .env read/edit denies, and external-directory ask behavior; unconfigured tools remain ask in the regression fixture
• policy discovery/read/PATCH must complete before prompt_async; failures return 502 and the prompt is not sent
• a process-local FIFO keyed by canonical directory + session covers activation through prompt acceptance, preventing concurrent Plan/Build requests from running under each other's policy
• queue release and map cleanup run in finally; rejected activation is ignored by the successor wait and cannot poison later prompts
• repeated same-mode prompts compare the exact current suffix and do not grow the append-only session ruleset

Verification

• npm run typecheck
• npm test (14 files, 143 tests passed)
• npm run build
• lockf -k /tmp/custom-dca-opencode-e2e.lock npm run test:e2e (106 tests passed)
• git diff --check

[leoncheng57]

Addressed the blocking concurrency review in fcb9ddf. Policy activation and prompt_async are now serialized per directory/session, with finally cleanup and rejection-safe successor waits. Added a deterministic held-PATCH E2E proving concurrent Plan/Build prompts each run under their requested effective policy, plus a same-session retry after activation failure. Full gate: 143 unit and 106 E2E tests passed.