refactor: wave 2 - split atlas, auto-update-checker, session-recovery, todo-enforcer, background-task hooks

- Extract atlas/ into 15 focused modules (hook, event handler, tool policies, types, etc.)
- Split auto-update-checker into checker/ and hook/ subdirectories with single-purpose files
- Decompose session-recovery into separate recovery strategy files per error type
- Extract todo-continuation-enforcer from monolith to directory with dedicated modules
- Split background-task/tools.ts into individual tool creator files
- Extract command-executor, tmux-utils into focused sub-modules
- Split config/schema.ts into domain-specific schema files
- Decompose cli/config-manager.ts into focused modules
- Rollback skill-mcp-manager, model-availability, index.ts splits that broke tests
- Fix all import path depths for moved files (../../ -> ../../../)
- Add explicit type annotations to resolve TS7006 implicit any errors

Typecheck: 0 errors
Tests: 2359 pass, 5 fail (all pre-existing)

src/config/schema/internal/permission.ts

@@ -0,0 +1,20 @@
+import { z } from "zod"
+
+export const PermissionValueSchema = z.enum(["ask", "allow", "deny"])
+export type PermissionValue = z.infer<typeof PermissionValueSchema>
+
+const BashPermissionSchema = z.union([
+  PermissionValueSchema,
+  z.record(z.string(), PermissionValueSchema),
+])
+
+export const AgentPermissionSchema = z.object({
+  edit: PermissionValueSchema.optional(),
+  bash: BashPermissionSchema.optional(),
+  webfetch: PermissionValueSchema.optional(),
+  task: PermissionValueSchema.optional(),
+  doom_loop: PermissionValueSchema.optional(),
+  external_directory: PermissionValueSchema.optional(),
+})
+
+export type AgentPermission = z.infer<typeof AgentPermissionSchema>