[Security] Enforce least-privilege connector permissions and action approval

[fettpl]

Summary

• Makes connector permissions explicit and deny-by-default: omitted or stale grants migrate to disabled, review-required state, and unknown or newly advertised tools remain denied.
• Adds first-party risk classification that does not trust connector-provided annotations, with remote command/filesystem and unknown actions at the highest confirmation tier.
• Adds a bounded, process-local approval broker for protected calls. One-use approvals are scoped to session, connector, tool, risk, the complete Schema-decoded argument tree, and the complete connector authorization configuration through a domain-separated HMAC-SHA-256.
• Enforces prepare → arm → one-way commit/cancel ordering, revalidates connector configuration immediately before consumption and invocation, checks deadlines at every transition, timing-safely compares digests, and cancels pending work on abort or session shutdown.
• Adds explicit tool-grant review in Settings and a blocking agent approval surface that displays bounded redacted metadata only.
• Routes packaged desktop connector, probe, plugin, and Google-account management through a finite Schema-validated private IPC bridge. The corresponding embedded HTTP routes fail with 403 before authentication, body parsing, or side effects, while web/development HTTP behavior remains available.
• Keeps runtime inventory and call reads non-persisting, validates private responses, sanitizes provider/connector failures, and prunes raw traced source directories from the standalone artifact without removing the compiled broker runtime.

Closes #231

Depends on #244, whose exact-commit release-gating commit is the base of this branch.

Validation

• Exact reviewed head: 8607bcd48ff879b6e6ee503af917bb3d037ffbdf.
• Focused connector/service/desktop IPC regressions: 38 passed, 0 failed, 208 expectations.
• Extra hermetic lifecycle checks passed for cancel-versus-commit, expiry-versus-commit, conflicting transactions, and one-use races.
• npm --prefix frontend run check:quality: passed.
• npm run check: passed across contracts, structure, frontend quality/build, controller checks, and discovered regressions.
• npm --prefix services/agent-runtime run build: passed.
• The current base has no npm --prefix frontend run test or root npm run test:integration script; the complete discovered tests/frontend Bun suite was run directly instead of claiming unavailable wrappers.
• Two independent P0/P1 reviews approved the exact head: one covered broker/digest/state-machine behavior and server-side enforcement; the other covered packaged IPC, embedded HTTP denial, non-persisting reads, error schemas, and standalone trace/runtime completeness.
• The pruned standalone server booted with /api/desktop-health returning 200, retained connector inventory over authenticated HTTP, rejected malformed management requests with 403 before parsing, and returned a Schema-valid private list-connectors IPC response.
• npm --prefix frontend run desktop:dist: passed. Local signing was skipped because no trusted matching signing identity is installed; ZIP and DMG artifacts were otherwise built successfully.
• The canonical /Applications/Local Studio.app was cleanly replaced and relaunched. Its packaged /api/desktop-health returned HTTP 200 with {"ok":true}.
• Ten packaged connector/approval/plugin/Google management route checks returned 403 before parsing, covering GET and mutation methods.
• The normal pre-push hook reran the complete frontend quality/build gate and passed before the exact branch update.

UI changes

Settings now requires users to review the discovered connector tool inventory and save an explicit allowlist before enablement. Protected agent actions display a blocking, session-scoped approval prompt containing only bounded redacted argument structure and risk information. Packaged desktop settings use the native private bridge without changing the web/development workflow.

Risks / rollout notes

• Merge [CI/CD] Gate every release on the exact commit that passed CI #244 first so this stacked PR reduces to the single connector-authorization commit.
• Pending approvals are intentionally process-local and fail closed across restart; users must approve a new request after restart or expiry.
• Issue [Security] Reapprove changed plugin artifacts and minimize MCP child environments #233 is the dependent artifact-identity boundary for same-version plugin file replacement and minimal child environments. This PR establishes the permission and approval substrate it requires without claiming that later artifact work.
• Fork-originated CI and Security workflows may require upstream maintainer approval before they run.

Workflow state

The exact-head fork workflows require maintainer approval before jobs can execute:

• CI run 29725784553
• Security run 29725784468

[0xSero]

Keeping open for rework. Add deny-by-default grants and server-enforced session-scoped one-use approvals on current connector architecture. The current branch is an obsolete dependency stack, not a merge candidate.

[0xSero]

Closing the historical implementation branch while retaining the linked security or reliability issue. This dirty main-targeted snapshot is not reviewable; land the requirement as a narrow current-dev PR with current gates and acceptance evidence.