feat(agents): add centralized GPT apply_patch permission guard

Extract hardcoded GPT apply_patch permission logic into a reusable module
to ensure consistent behavior across all agents. This prevents GPT models
from using the unreliable apply_patch tool while allowing other models.

- Add gpt-apply-patch-guard.ts with GPT_APPLY_PATCH_GUIDANCE and getGptApplyPatchPermission
- Update Hephaestus agent to use centralized permission logic
- Update Sisyphus-Junior agent to use centralized permission logic
- Update all GPT prompt builders to reference shared guidance constant

🤖 Generated with assistance of OhMyOpenCode

src/agents/sisyphus-junior/agent.ts

@@ -18,6 +18,7 @@ import {
   createAgentToolRestrictions,
   type PermissionValue,
 } from "../../shared/permission-compat"
+import { getGptApplyPatchPermission } from "../gpt-apply-patch-guard"
 
 import { buildDefaultSisyphusJuniorPrompt } from "./default"
 import { buildGptSisyphusJuniorPrompt } from "./gpt"
@@ -103,7 +104,11 @@ export function createSisyphusJuniorAgentWithOverrides(
     merged[tool] = "deny"
   }
   merged.call_omo_agent = "allow"
-  const toolsConfig = { permission: { ...merged, ...basePermission } }
+  const toolsConfig = { permission: { ...merged, ...basePermission } as Record<string, PermissionValue> }
+  const permission: Record<string, PermissionValue> = {
+    ...toolsConfig.permission,
+    ...getGptApplyPatchPermission(model),
+  }
 
   const base: AgentConfig = {
     description: override?.description ??
@@ -114,7 +119,7 @@ export function createSisyphusJuniorAgentWithOverrides(
     maxTokens: 64000,
     prompt,
     color: override?.color ?? "#20B2AA",
-    ...toolsConfig,
+    permission,
   }
 
   if (override?.top_p !== undefined) {