fix(permissions): hide denied tools from API schema

[panDing19]

Summary

• Problem: permission.denied_tools only blocked tools at execution time. The query loop still sent every registered tool schema to the model, so denied tools stayed visible and the model could select tools that would immediately be rejected by PermissionChecker.

• Change: ToolRegistry.to_api_schema() now accepts an optional denied_tools filter, PermissionChecker exposes its denied tool names as a read-only tuple, and run_query() applies that filter before sending tool schemas to the API. Execution-time permission checks remain unchanged as the enforcement backstop.

• Added regression coverage for both the registry filter and the query engine request payload, and added an Unreleased changelog entry for the user-visible permissions behavior change.

Validation

• uv run ruff check src tests scripts
• uv run pytest -q — 1155 passed, 6 skipped when run with inherited ANTHROPIC_AUTH_TOKEN / ANTHROPIC_BASE_URL cleared so auth tests are not biased by the local Codex session environment.
• cd frontend/terminal && npx tsc --noEmit — not applicable; no frontend files touched.

Notes

• Related issue: N/A
• Follow-up work: None.