feat(config): permission_for() + upgrade_to_always()

LoadedConfig gains methods for tool approval policy:
- permission_for(tool_name) → "always" | "ask" | "never"
- upgrade_to_always(tool_name) — session-only override

sunbeam/src/code/config.rs

@@ -55,6 +55,35 @@ impl Default for LoadedConfig {
     }
 }
 
+impl LoadedConfig {
+    /// Get the permission level for a tool. Returns "always", "ask", or "never".
+    pub fn permission_for(&self, tool_name: &str) -> &str {
+        match tool_name {
+            "file_read" => &self.file_read_perm,
+            "file_write" => &self.file_write_perm,
+            "search_replace" => &self.search_replace_perm,
+            "grep" => &self.grep_perm,
+            "bash" => &self.bash_perm,
+            "list_directory" => &self.list_directory_perm,
+            _ => "ask", // unknown tools default to ask
+        }
+    }
+
+    /// Upgrade a tool's permission to "always" for this session (in-memory only).
+    pub fn upgrade_to_always(&mut self, tool_name: &str) {
+        let target = match tool_name {
+            "file_read" => &mut self.file_read_perm,
+            "file_write" => &mut self.file_write_perm,
+            "search_replace" => &mut self.search_replace_perm,
+            "grep" => &mut self.grep_perm,
+            "bash" => &mut self.bash_perm,
+            "list_directory" => &mut self.list_directory_perm,
+            _ => return,
+        };
+        *target = "always".into();
+    }
+}
+
 /// Load project config from .sunbeam/config.toml.
 pub fn load_project_config(project_path: &str) -> LoadedConfig {
     let config_path = std::path::Path::new(project_path)