Change permission checks from sandbox-only to all worktree loops.
In-place loops now fall through to host default permissions.

- Add database connection caching in src/storage/database.ts to share SQLite handle across sub-instances
- Refactor src/index.ts to return hooks immediately and initialize services in background
- Use initPromise pattern to defer expensive operations (DB init, graph service, sandbox setup)
- All hooks now await initPromise before executing, allowing POST /session to return quickly
- Database caching uses refcounting to ensure proper lifecycle management

Expected performance improvement:
- Cold bootstrap: ~90ms → ~15ms
- Subsequent sub-instances: ~90ms → ~1ms (reusing cached DB connection)

buildLoopPermissionRuleset was called without excludedTools at 3 of 5
call sites (rotateSession, CLI restart, TUI restart), defeating the
agent tool exclusion feature after the first iteration or restart.

Extract getAgentExcludedTools helper to dedupe the 5 existing
agents.code / agent?.tools?.exclude ?? [] blocks and prevent future
omissions.

Migration 111 made review_findings.scenario nullable, so formatReviewFindings
could render the literal string 'Scenario: null' in the audit prompt.
Fall back to 'N/A' to match the pattern in src/tools/review.ts.

fix-agent-perms → main