L2: permission mode propagation across forward/calendar/adopt + PUT endpoint + tests

P1 - forward inherits mode:
- doForward: when creating a new target session, use InheritedMode from
  the source session (plan parent → plan child, cannot escalate)
- enforcement snapshot set from receiving agent

P1 - calendar_events gets permission_mode column:
- Added to 3 migration sites (sqlite init, pg init, incremental alter)
- CalendarEvent model gains PermissionMode field
- CreateCalendarEvent / UpdateCalendarEvent normalize + persist the field
- resolveCalendarSession: on new session → write event's mode;
  on reuse → ModeAtMost(cur, eventMode), prevents escalation
  (plan Agent's reminder fires into a workspace session = bypass)
- SendCalendarMail now takes permMode and threads it through
- fireEvent passes event.PermissionMode to all delivery paths

P1 - AdoptPlatformSession explicitly writes default mode:
- Writes DefaultPermissionMode + enforcement on adopt, instead of
  relying on DB column default (avoids silent drift on schema changes)

P2 - PUT /sessions/{id}/permission endpoint:
- New handler UpdateSessionPermission (auth required, access check)
- Registers PUT route alongside existing budget/alias endpoints
- Broadcasts session_update on change
- Does NOT refresh enforcement (design: snapshot at creation)

P3 - Tests (24 new cases):
- permission_mode_test.go: InheritedMode (6 cases), SetSessionPermissionMode
  roundtrip, dirty value fail-closed, NormalizePermissionMode, calendar event
  roundtrip/dirty/update, adopt writes default mode, plan escalation guard,
  3-level inheritance chain
- defaultsession_test.go: budget regression, permission mode regression
  (pins created=false → no reset on reuse)

Deploys with: bash deploy/redeploy-gateway.sh --skip-tests
Schema migration: auto via addMissingColumns (new column default 'workspace')

gateway/internal/models/calendar.go

@@ -53,6 +53,13 @@ type CalendarEvent struct {
 	Status      string     `json:"status"` // active/paused/cancelled
 	LastFiredAt *time.Time `json:"last_fired_at,omitempty"`
 
+	// PermissionMode 是事件触发时新建会话应采用的档位（plan / workspace / full）。
+	// 空 = workspace（默认）。
+	// 复用已有会话时不能直接搬用：要 ModeAtMost(会话现档, 事件档) ——
+	// 事件档表示「这件事允许到什么程度」，而会话现档可能更严（plan 档派出的
+	// 任务不该因为日程触发就偷偷升到 workspace）。
+	PermissionMode string `json:"permission_mode"`
+
 	// FiredFor 是已触发的那个 occurrence（值 = 当时的 EventTime）。
 	// 去重靠它与 EventTime 相等判断，不是拿 LastFiredAt 比大小 ——
 	// DueEvents 有 60 秒 lookahead，后者在窗口内恒为真会导致每 tick 重发。