ACP permission cache key null-byte collision vector

## Context

Tool names from `acp-permissions.toml` inserted into cache without stripping null bytes. Cache key format `{session_id}\0{tool_name}` could collide.

## Solution

Filter null bytes from tool names when loading persisted permissions.

**Epic:** #854 | **Effort:** S | **Crate:** zeph-acp