feat(agents): add centralized GPT apply_patch permission guard

Extract hardcoded GPT apply_patch permission logic into a reusable module
to ensure consistent behavior across all agents. This prevents GPT models
from using the unreliable apply_patch tool while allowing other models.

- Add gpt-apply-patch-guard.ts with GPT_APPLY_PATCH_GUIDANCE and getGptApplyPatchPermission
- Update Hephaestus agent to use centralized permission logic
- Update Sisyphus-Junior agent to use centralized permission logic
- Update all GPT prompt builders to reference shared guidance constant

🤖 Generated with assistance of OhMyOpenCode

src/hooks/auto-update-checker/checker/cached-version.ts

@@ -6,13 +6,17 @@ import type { PackageJson } from "../types"
 import { INSTALLED_PACKAGE_JSON_CANDIDATES } from "../constants"
 import { findPackageJsonUp } from "./package-json-locator"
 
+function readPackageVersion(packageJsonPath: string): string | null {
+  const content = fs.readFileSync(packageJsonPath, "utf-8")
+  const pkg = JSON.parse(content) as PackageJson
+  return pkg.version ?? null
+}
+
 export function getCachedVersion(): string | null {
   for (const candidate of INSTALLED_PACKAGE_JSON_CANDIDATES) {
     try {
       if (fs.existsSync(candidate)) {
-        const content = fs.readFileSync(candidate, "utf-8")
-        const pkg = JSON.parse(content) as PackageJson
-        if (pkg.version) return pkg.version
+        return readPackageVersion(candidate)
       }
     } catch {
       // ignore; try next candidate
@@ -23,9 +27,7 @@ export function getCachedVersion(): string | null {
     const currentDir = path.dirname(fileURLToPath(import.meta.url))
     const pkgPath = findPackageJsonUp(currentDir)
     if (pkgPath) {
-      const content = fs.readFileSync(pkgPath, "utf-8")
-      const pkg = JSON.parse(content) as PackageJson
-      if (pkg.version) return pkg.version
+      return readPackageVersion(pkgPath)
     }
   } catch (err) {
     log("[auto-update-checker] Failed to resolve version from current directory:", err)
@@ -35,9 +37,7 @@ export function getCachedVersion(): string | null {
     const execDir = path.dirname(fs.realpathSync(process.execPath))
     const pkgPath = findPackageJsonUp(execDir)
     if (pkgPath) {
-      const content = fs.readFileSync(pkgPath, "utf-8")
-      const pkg = JSON.parse(content) as PackageJson
-      if (pkg.version) return pkg.version
+      return readPackageVersion(pkgPath)
     }
   } catch (err) {
     log("[auto-update-checker] Failed to resolve version from execPath:", err)