feat(FN-1122): add agent permission access APIs

- Define canonical agent permission types and export permission helpers from @fusion/core
- Add permission normalization and access-state computation with role defaults plus explicit grants
- Extend AgentStore with getAccessState and add unit tests for permission logic and store behavior
- Add dashboard routes for GET /api/agents/:id/access and PATCH /api/agents/:id/permissions with request validation and serialization
- Add a minor changeset for @gsxdsm/fusion documenting the new agent permission endpoints

packages/core/src/agent-store.ts

@@ -32,8 +32,10 @@ import type {
   AgentTaskSession,
   AgentConfigRevision,
   AgentConfigSnapshot,
+  AgentAccessState,
 } from "./types.js";
 import { AGENT_VALID_TRANSITIONS, agentToConfigSnapshot, diffConfigSnapshots } from "./types.js";
+import { computeAccessState } from "./agent-permissions.js";
 
 /** Events emitted by AgentStore */
 export interface AgentStoreEvents {
@@ -175,6 +177,20 @@ export class AgentStore extends EventEmitter {
     }
   }
 
+  /**
+   * Get computed access capabilities for an agent.
+   * @param agentId - The agent ID
+   * @returns Computed access state, or null if agent not found
+   */
+  async getAccessState(agentId: string): Promise<AgentAccessState | null> {
+    const agent = await this.getAgent(agentId);
+    if (!agent) {
+      return null;
+    }
+
+    return computeAccessState(agent);
+  }
+
   /**
    * Get detailed agent info including heartbeat history.
    * @param agentId - The agent ID