feat(FN-3560): add permanent agent gating enforcement in pi with tool class

The merge lands three major features: a permanent-agent gating system (FN-3560, 6 steps) that classifies and enforces tool access policies for permanent agents in the PI extension, with full test coverage and updated agent docs; an OpenClaw MCP bridge (FN-3717) adding MCP config, schema server, and

Fusion-Task-Id: FN-3560

packages/engine/src/__tests__/runtime-selection-regression.test.ts

@@ -128,14 +128,22 @@ describe("Runtime Selection Regression Tests", () => {
 
       const { createResolvedAgentSession } = await import("../agent-session-helpers.js");
 
+      const permanentAgentGating = {
+        permissionPolicy: {
+          presetId: "approval-required",
+          rules: { command_execution: "require-approval" as const },
+        },
+      };
+
       await createResolvedAgentSession({
         sessionPurpose: "executor",
         pluginRunner: {} as any,
         cwd: "/test/path",
         systemPrompt: "Test prompt",
+        permanentAgentGating,
       });
 
-      expect(mockCreateSession).toHaveBeenCalled();
+      expect(mockCreateSession).toHaveBeenCalledWith(expect.objectContaining({ permanentAgentGating }));
     });
 
     it("should return runtime metadata along with session", async () => {