request.options (or its optionId), or the
shorthands "allow" / "reject" for a one-shot decision (the _once
option variant when offered).
Set client-wide as a default for every session, or per session via
createSession({ onPermission }) / session.onPermission — the session
handler wins. request.call carries the merged snapshot of the gated tool
call (title, kind, rawInput, …).

