docs: correct policy action names

[xiajiahang]

Issue for this PR

Closes #54214

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

The policy examples use permission, which the config schema rejects. Use tool.use in the policies, config, and permissions guides, and list the three supported policy actions. Explain integration.use resources with an MCP server and skill allowlist example.

How did you verify your code works?

• Decoded all 20 policy examples from the three guides with ConfigPolicy.Info: all accepted. The original examples had 7 rejected statements.
• packages/core: bun test test/config/policy.test.ts — 13 passed.
• services/www: bun typecheck and bun run check:generated passed.
• services/www: bun run build passed, including link validation.
• Root bun run check: lint completed with 0 errors; typecheck blocked by missing @solidjs/start imports in the unchanged Console support package (the initial run also encountered this dependency issue in the stats app).

Screenshots / recordings

Not applicable; documentation content only.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

[github-actions]

The following comment was made by an LLM, it may be inaccurate:

[opencode-agent]

Looks right to me. I compared the docs against the code. ConfigPolicy.Info only accepts provider.use, tool.use and integration.use. The permission hard-deny hook in packages/core/src/config/plugin/policy.ts matches tool.use against <action>:<value>, and the last matching statement wins. That fits the corrected examples and the "allow only lifts an earlier deny" wording. No other "action": "permission" examples are left in the docs. This is docs-only, so there was nothing to run.

Public API: unchanged. This only updates the documentation of the existing config keys.

One small gap, not blocking: the actions table now lists integration.use, but the page never says what it controls or what its resources look like. In the code, integration.use statements remove MCP servers (mcp:<server>) and skills (skill:<id>). A short section with an example, like the existing Permissions section, would mean readers don't have to guess.

Related: #54100