Add permission modes and container introspection backend

Permission modes: replaces the binary full_permissions flag with a
PermissionMode enum (Plan/Default/AcceptEdits/Bypass). Flag mapping is
defined once in PermissionMode::cli_args() and used by the terminal, the
web terminal, and the scheduler:
  Plan        -> --permission-mode plan
  Default     -> (no flag)
  AcceptEdits -> --permission-mode acceptEdits
  Bypass      -> --dangerously-skip-permissions
Choices verified against `claude --permission-mode` on 2.1.226.

full_permissions is retained and effective_permission_mode() falls back
to it, so existing projects.json needs no migration.

Bug fix: triple-c-task-runner ran `claude -p ... --dangerously-skip-
permissions` unconditionally, ignoring the project's setting entirely.
It now reads TRIPLE_C_PERMISSION_MODE, which is injected into the
container, added to the reserved env blocklist, propagated through the
entrypoint's cron env filter, and tracked by a new
triple-c.permission-mode label so a change forces recreation.

Introspection: new commands/inspect_commands.rs exposes read-only views
into the container over docker exec — Claude sessions (parsed from
~/.claude/projects/<cwd>/<uuid>.jsonl), installed capabilities (skills,
agents, commands, hooks, plugins, natively-configured MCP servers), and
the triple-c-scheduler task list, logs and notifications.

Task/session ids are validated against a strict allowlist and every
parameterized call runs as a bare argv vector via bollard, so no shell
is involved. Stopped containers return empty results rather than errors.

No UI yet; that lands with the Project Home view.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

container/triple-c-task-runner

@@ -47,6 +47,21 @@ WORKING_DIR=$(jq -r '.working_dir // "/workspace"' "$TASK_FILE")
 TASK_NAME=$(jq -r '.name' "$TASK_FILE")
 TASK_TYPE=$(jq -r '.type' "$TASK_FILE")
 
+# ── Resolve permission mode ─────────────────────────────────────────────────
+# TRIPLE_C_PERMISSION_MODE is injected into the container by Triple-C from the
+# project's permission setting. Keep this mapping in sync with
+# PermissionMode::cli_args() in app/src-tauri/src/models/project.rs.
+# NOTE: headless `claude -p` runs cannot answer a permission prompt, so any
+# mode other than "bypass" means the task may stop early when Claude Code asks
+# for permission. Unset or unrecognized values pass no flag (Claude's default).
+PERMISSION_ARGS=()
+case "${TRIPLE_C_PERMISSION_MODE:-}" in
+    plan)        PERMISSION_ARGS=(--permission-mode plan) ;;
+    acceptEdits) PERMISSION_ARGS=(--permission-mode acceptEdits) ;;
+    bypass)      PERMISSION_ARGS=(--dangerously-skip-permissions) ;;
+    *)           PERMISSION_ARGS=() ;;
+esac
+
 # ── Prepare log directory ───────────────────────────────────────────────────
 TASK_LOG_DIR="${LOGS_DIR}/${TASK_ID}"
 mkdir -p "$TASK_LOG_DIR"
@@ -60,13 +75,15 @@ LOG_FILE="${TASK_LOG_DIR}/${TIMESTAMP}.log"
     echo "=== Started: $(date) ==="
     echo "=== Working dir: $WORKING_DIR ==="
     echo "=== Prompt: $PROMPT ==="
+    echo "=== Permission mode: ${TRIPLE_C_PERMISSION_MODE:-default} ==="
     echo ""
 } > "$LOG_FILE"
 
 EXIT_CODE=0
 if [ -d "$WORKING_DIR" ]; then
     cd "$WORKING_DIR"
-    claude -p "$PROMPT" --dangerously-skip-permissions >> "$LOG_FILE" 2>&1 || EXIT_CODE=$?
+    # ${arr[@]+"${arr[@]}"} keeps an empty array safe under `set -u`
+    claude -p "$PROMPT" ${PERMISSION_ARGS[@]+"${PERMISSION_ARGS[@]}"} >> "$LOG_FILE" 2>&1 || EXIT_CODE=$?
 else
     echo "Error: working directory '$WORKING_DIR' does not exist" >> "$LOG_FILE"
     EXIT_CODE=1