Clamp child thread permission mode to the parent's mode

[sholub-dev]

Fixes #1593.

Summary

• The parent thread's last-executed permission mode is now a hard ceiling for managed child threads. resolveThreadExecutionPermissionMode resolves the preferred mode as before (explicit request, then the child's recorded mode, then parent inheritance, then project defaults) and then clamps it with the existing clampPermissionModeToCeiling domain helper.
• This closes both escalation paths: an explicit --permission-mode full from a sandboxed parent now resolves to the parent's mode, and provider-support reconciliation can no longer upgrade an inherited mode (a Pi child of an auto parent fails provider validation instead of silently getting full).
• A child can still run below its parent's mode, and a full parent's children are unaffected.
• Updated the bb-cli skill and the threads guide template to document the ceiling.

AGENT GENERATED: by Claude Fable 5