Thread `suggestedScope` through the app-server permission approval
request and use it when constructing TUI approval requests. This
keeps the protocol backward compatible by defaulting the field to
`turn` when older clients omit it.
Add focused app-server and TUI coverage, plus a snapshot for the
session-suggested approval overlay so reviewers can see the
preselected session row.
Adds a built-in `request_permissions` tool and wires it through the
Codex core, protocol, and app-server layers so a running turn can ask
the client for additional permissions instead of relying on a static
session policy.
The new flow emits a `RequestPermissions` event from core, tracks the
pending request by call ID, forwards it through app-server v2 as an
`item/permissions/requestApproval` request, and resumes the tool call
once the client returns an approved subset of the requested permission
profile.