Honor skip-permissions through pre-gate workspace sandboxes - #436

CL-5807

Self-review

What this fixes. Gate already short-circuits on skipPermissions, but path-escape / delete_file / list_dir / shell cwd retention still hard-denied outside the workspace after the gate had already allowed the call. That is exactly the CL-5807 friction (other-repo path tools, git clone / network shell under yolo).

Approach. Expose immutable getSkipPermissions() on the gate and snapshot it once when building the toolset plugins. Default remains deny-outside; only the explicit yolo flag opens the fence. Secret-guard and authz stay earlier/independent middleware and still hard-deny.

Checks I care about.

• Without skip: outside-workspace read_file still errors with path-escape (covered).
• With skip: outside-workspace read_file, list_dir, delete_file parent bounds, and per-call / retained shell cwd all pass (covered).
• Gate-level: skip still never invokes the approval callback; git clone and out-of-workspace path tools auto-allow without ask (covered).
• Plugin order keeps secret-guard + authz between path-escape and execution.

Residual risk (accepted).

• Under yolo, shell may retain a cwd outside the session root for the rest of the session — intentional for the escape hatch.
• allowOutside is fixed at toolset construction; fine because skipPermissions is immutable after gate create.
• Auto-shell policy denies also short-circuit under skip (pre-existing gate behavior, not introduced here).

No code changes from this review. Ready to merge.