Copying assets between artifacts now respects deny/ask permission rules, not just prior consent.
Copying assets between artifacts via action: "copy_from" now consults the permission-rule engine for deny and ask rules before proceeding, instead of only checking consent/session state as before. A matching deny rule blocks the copy with a message naming the rule's tool and pattern, and a matching ask rule forces a confirmation prompt even if the destination or source was already consented.
Reading an artifact's structured page data (read_page_data) is now also checked against this permission-rule engine before fetching. Previously a session-wide "Read artifacts' structured page data for the rest of this session" grant auto-allowed all such reads; now a matching ask rule shows a one-shot confirmation instead, and a matching deny rule refuses the read entirely.