Permission-prompt "don't ask again" rows are now minted, frozen and verified

Chrome/domain, Skill, Bash-prefix, plan-mode, and MCP permission dialogs no longer build permission updates on the fly when you answer. Each option is minted ahead of time into a displayed row, pairing its label with the exact update it applies, through a shared helper that deep-freezes the update payload and rejects anything that isn't plain data: functions, accessors, symbol keys, or prototype keys. If a row is missing or fails verification at answer time, the dialog falls back to a plain allow or deny rather than applying an unverified rule. The always-allow row is also withheld when the prompt came from a non-classifier-approvable safety check, when capped by org policy, or when the host contains a wildcard.