Foreign-org artifact reads get a dedicated permission path

What

• The read-permission checker now has an explicit branch for content flagged as outside the user's organization (outsideOrg), returning a foreign_read decision tagged about: "outside_org" before falling through to the existing owned/network-off checks.
• New guard text distinguishes three situations when such a foreign-org read or copy is blocked: nobody was asked and it should be retried, nobody can be asked in this session so it shouldn't be retried, or a PermissionRequest hook (an automated rule that answers permission prompts for the user) already answered on the user's behalf. In that last case, Claude is told that only the user's own approval actually allows the read, and to inform the user that their hook auto-answered.

Why This closes a gap where an automated permission hook could silently approve access to another organization's artifact; Claude now knows to flag that to the user rather than treating the hook's answer as sufficient.