fix(permissions): preserve explicit deny over OmO defaults

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

src/plugin-handlers/tool-config-handler.ts

@@ -116,9 +116,9 @@ export function applyToolConfig(params: {
   }
 
   params.config.permission = {
-    ...(params.config.permission as Record<string, unknown>),
     webfetch: "allow",
     external_directory: "allow",
+    ...(params.config.permission as Record<string, unknown>),
     task: "deny",
   };
 }