Decouple engine.permission-mode from bash-wildcard auto-selection

[ladamski]

Summary

The Claude engine auto-selects --permission-mode bypassPermissions
whenever the compiled tool set contains a bash wildcard
(pkg/workflow/claude_engine.go hasBashWildcardInTools). The network
egress firewall injects bash: ["*"], so enabling the firewall
implicitly disables --allowed-tools enforcement (see #28046, #28120).

There is no first-class config field for the permission mode. The only
override is appending a second --permission-mode <value> via
engine.args and relying on Claude Code honoring the last occurrence
of the flag — undocumented behavior that would silently regress to
bypassPermissions if gh-aw ever dedupes engine flags.

acceptEdits (gh-aw's non-wildcard default) does enforce
--allowed-tools, but its static bash filter rejects shell variable
expansion ("$VAR") and compound commands, so workflows that call e.g.
gh pr view "$PR_NUMBER" cannot use it. That leaves auto as the only
viable mode for such workflows, and it is only reachable via the
engine.args workaround.

Affected Area

pkg/workflow/claude_engine.go — hasBashWildcardInTools and
--permission-mode flag emission.

Reproduction

1. Compile a workflow that enables the network egress firewall.
2. Inspect the compiled lock file: --permission-mode bypassPermissions
   is emitted.
3. Inspect the Claude Code session-init JSON in the run log:
   "permissionMode": "bypassPermissions"; --allowed-tools has no
   effect.

Expected Behavior

1. The permission mode is a first-class, validated config field, e.g.:

   engine:
     id: claude
     permission-mode: auto  # auto | acceptEdits | plan | bypassPermissions

   The compiler emits exactly one --permission-mode flag and surfaces
   the chosen value in the compiled lock file.

2. The presence of a bash wildcard in the tool set is not the sole
   trigger for bypassPermissions. Enabling the network egress
   firewall and keeping a strict --allowed-tools boundary are
   independent choices.

Related

• Claude engine: bypassPermissions mode makes --allowed-tools ineffective — gateway tool set is the sole agent tool boundary #28046 — bypassPermissions makes --allowed-tools ineffective
• [deep-report] Document bypassPermissions + --allowed-tools security boundary and add gateway-side enforcement #28120 — documentation + gateway-side enforcement follow-up