Skill evaluator rejects shell calls before typed permission checks #1276

Problem

AgentRunner.BuildSessionConfig currently returns PermissionDecision = "ask" from OnPreToolUse for normal shell tools. With GitHub.Copilot.SDK 1.0.11 this produces a generic PermissionRequestHook, not PermissionRequestShell.

DecidePermissionRequest intentionally handles typed shell/read/write/MCP/URL requests and rejects unknown request variants. The generic hook therefore fails with Unsupported permission request during evaluation before CheckShellPermission can inspect PossiblePaths, PossibleUrls, link operations, or the pathless-command allowlist.

This prevents skills from running otherwise permitted local validation commands during native evaluation. It was reproduced while evaluating dotnet/maui-labs' Xcode 27 migration skill: every attempted audit command was denied before execution.

Proposed fix

• Preserve the explicit denyShell pre-hook denial.
• For normal shell tools, return no pre-hook decision and let the SDK issue the existing typed PermissionRequestShell.
• Continue rejecting unexpected generic hook permission requests.
• Add deterministic tests proving execution waits for permission, rejected requests never execute, and typed request metadata is preserved.

Validation

A local candidate passes the full validator suite (966/966). Authenticated native probes show:

• pwd: PermissionRequestShell emitted, approved by the existing policy, command executed successfully.
• cat /etc/passwd: PermissionRequestShell emitted, rejected by the existing policy, tool execution failed without exposing contents.

No allowlists or permission defaults are broadened.