Fast mode gains a per-session opt-in check

What

Fast mode (also called "penguin mode") now factors a sessionOptIn value into its eligibility logic instead of relying only on a bare unavailability check.

• The fast-mode-unavailable check now only blocks the request when the user is actually trying to turn fast mode on, not when merely checking status or disabling it.
• A new policy-settings-driven rejection path checks whether fast mode is disallowed by policy and whether it's restricted to per-session opt-in (fastModePerSessionOptIn).
• A new environment variable, CLAUDE_CODE_SKIP_FAST_MODE_ORG_CHECK, can skip the organization-level check, and this is recorded via a reason: "preference" marker.
• A new tengu_org_penguin_mode_fetch_refused telemetry event fires when the org status endpoint refuses the request with a specific permission error.
• Enabling fast mode now runs an extra promotion step after swapping the main-loop model, when the session-opt-in condition is met.

Why

This lets fast mode be gated per session rather than only by a blanket organization setting, so it can be turned on or off more precisely without the request being wrongly blocked when it's only a status check.