Connector tools allowed from a card are honoured in session permissions

What

Connectors are MCP servers, outside services that give Claude tools. Permission rules decide which tools may run without asking you. This release adds a new piece of permission state:

• connectorCardAllows: a new field in the permission state. It is not saved between sessions (not_serialized), and it is cleared when command rules are stripped.
• Allowed from a card: connector tools allowed from a card are honoured in the session's rules, unless the tool is destructive. Permission answers sent back by apps built on the SDK update this allowance.
• Ask rules: the permission check gains a step for ask rules that are specific to MCP tools.
• Poll events: one check that delivers poll events now also requires connectorCardAllows to be unset.

One finding also noted a new startup timing checkpoint, remote_mcp_servers_search, and a new bashTeachesHeredocOnStdin field among the agent tooling flags.

Why

This changes when you see permission prompts for connector tools. A tool you allowed from a card can run for the rest of the session without asking again. Tools that are destructive are still not allowed this way.