fix(access-control): default every operation and model picker to one the permission group allows - #6720

… rule

Block creation seeds `model` the same way it seeds `operation`: `agent`,
`router` and `evaluator` all declare `defaultValue: 'claude-sonnet-5'`, and
`prepareBlockState` wrote it unconditionally. The model combobox only fills a
field that is empty, so a group denying that model (or the Anthropic provider)
got an Agent block pre-filled with a model it cannot run — the same bug as the
operation one, on the other axis the permission group governs.

Rather than a second bespoke gate, `prepareBlockState` now takes one veto,
`isSeededValueAllowed(subBlockId, value)`, and seeds nothing when a declared
default is denied. Nothing substitutes a replacement there any more: the
editor's own permission-aware pickers already resolve the right one and only
fill an empty field, and substituting in the store would drift from
`getDefaultBlockName`, which names a block after its *declared* default. That
also deletes `firstAllowedOperation` and its copy of subblock-option
enumeration.

Review follow-ups:

- `usePermissionConfig` gains `isModelUsable` (denylist AND provider allowlist);
  the combobox's two hand-rolled copies of that pair now call it
- `isToolAllowed`/`isModelAllowed` index their denylists — the gate calls them
  once per option of every block offered, so a linear scan made a check's cost
  scale with denylist length (measured 3.2ms -> 0.30ms per search-index build
  at 500 denied tools)
- `useOperationAccess` had three members with three different loading
  semantics, one documented as unsafe alone; it now exposes one withholding
  `resolveOperationGate`
- the agent tool picker derived its option list twice with the empty-id filter
  on only one path; both callers now share one `{ options, denied }` result
- `OPERATION_SUBBLOCK_ID` was a verbatim copy of the private constant in
  `canvas-sentence.ts`, doc comment included; that file now imports it

Cleanup-pass findings on this branch's own lines: comments that restated the
code they sat on, a four-line note whose sibling said the same in one, and a
`?? undefined` on a non-nullable value. The comment on the tool-picker filter
now explains the clause that actually needed it (an empty option list is not a
denied one) instead of narrating the filter.

Left alone as pre-existing and out of scope: the inline `staleTime` literal in
`useAllowedIntegrationsFromEnv`, and the Operation selector's raw label /
plain `Combobox` — both byte-identical to staging and matching the convention
of every sibling field in that panel.

Block creation is one-shot, so the withholding pattern the editor's pickers use
does not transfer: withholding the predicate there meant `prepareBlockState`
seeded the declared `operation`/`model` defaults unchecked, and nothing
revisits a field that already holds a value — so a block added before the
permission config resolved kept a model the group may deny.

Both restricted fields now seed empty until the config is known; the pickers
fill them the moment it resolves. A preset operation is still honoured in that
window: unlike a declared default it is the user's explicit pick, and the
server gates the run.

Two review bots found the same class of bug in two more places, which is the
real finding: "never persist from a predicate that reads as unrestricted while
the config loads" was a rule each callsite re-implemented, and the rule had
already been forgotten twice.

Closes both reported instances and moves the rule somewhere it cannot be
forgotten again:

- `useOperationAccess.resolveSeedGate` now owns the creation-time veto for both
  restricted fields, so `workflow.tsx` states no policy of its own — it asks for
  a gate and passes it on. Previously the model half of the invariant was
  carried by an operation-shaped object that merely happened to be absent
  during the same window.
- The agent tool picker and both operation selectors close while the config is
  unknown. Every list they offer — blocks, operations, MCP and custom tools —
  reads as unrestricted for that beat, and each pick is a one-shot write.
- A preset operation goes through the same gate as a declared default. It comes
  from the search index, which is itself unfiltered while loading, so it is not
  the informed pick it looks like.
- `isPermissionLoading` is exposed from one hook, so all four surfaces read the
  same symbol instead of four spellings of the same condition.

Also from the review passes: dropped `isModelAllowed`/`isProviderAllowed` from
the public interface (consolidating onto `isModelUsable` left them with no
external consumer), un-exported `resolveOperationToolId` (no non-test caller),
and corrected the `isSeededValueAllowed` TSDoc, which still described the
contract the previous commit replaced.

Tests: replaced a case that asserted its own fixture rather than the code with
coverage of the two guard branches that were genuinely untested — an empty-string
and a non-string declared default must bypass the gate, since both mean "nothing
was declared" rather than a value to authorize.