fix(agents): clear stale frontier tool denies

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

src/agents/builtin-agents/hephaestus-agent.ts

@@ -8,7 +8,7 @@ import { applyEnvironmentContext } from "./environment-context"
 import { applyCategoryOverride, mergeAgentConfig } from "./agent-overrides"
 import { applyModelResolution, getFirstFallbackModel } from "./model-resolution"
 import { getGptApplyPatchPermission } from "../gpt-apply-patch-guard"
-import { getFrontierToolSchemaPermission } from "../frontier-tool-schema-guard"
+import { applyFrontierToolSchemaPermission } from "../frontier-tool-schema-guard"
 
 export function maybeCreateHephaestusConfig(input: {
   disabledAgents: string[]
@@ -90,10 +90,11 @@ export function maybeCreateHephaestusConfig(input: {
   }
 
   const resolvedModel = hephaestusConfig.model ?? ""
-  const frontierDeny = getFrontierToolSchemaPermission(resolvedModel)
-  if (Object.keys(frontierDeny).length > 0 && hephaestusConfig.permission) {
-    Object.assign(hephaestusConfig.permission, frontierDeny)
-  }
+  hephaestusConfig.permission = applyFrontierToolSchemaPermission(
+    hephaestusConfig.permission,
+    resolvedModel,
+    hephaestusOverride?.permission
+  )
 
   const gptDeny = getGptApplyPatchPermission(resolvedModel)
   if (Object.keys(gptDeny).length > 0 && hephaestusConfig.permission) {