Function resolve_permission_behavior 

pub fn resolve_permission_behavior(
    snapshot: &Value,
    tool_id: &str,
) -> ToolPermissionBehavior

Resolve effective permission behavior from a state snapshot.

Resolution order:

1. CRDT policy (permission_policy): denied_tools → allowed_tools
2. Legacy per-tool overrides (permissions.tools)
3. permission_policy.default_behavior or permissions.default_behavior
4. Default: Ask