fix(athena): add call_omo_agent to ATHENA_RESTRICTIONS for consistent tool denial

ATHENA_RESTRICTIONS only denied write and edit, missing call_omo_agent that the agent factory already denies. This caused 6 callers of getAgentToolRestrictions() to get incomplete restrictions.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

src/shared/agent-tool-restrictions.test.ts

@@ -0,0 +1,33 @@
+import { describe, expect, test } from "bun:test"
+import {
+  getAgentToolRestrictions,
+  hasAgentToolRestrictions,
+} from "./agent-tool-restrictions"
+
+describe("agent-tool-restrictions", () => {
+  test("athena restrictions include call_omo_agent", () => {
+    //#given
+    //#when
+    const restrictions = getAgentToolRestrictions("athena")
+    //#then
+    expect(restrictions.write).toBe(false)
+    expect(restrictions.edit).toBe(false)
+    expect(restrictions.call_omo_agent).toBe(false)
+  })
+
+  test("council-member restrictions include call_omo_agent", () => {
+    //#given
+    //#when
+    const restrictions = getAgentToolRestrictions("council-member")
+    //#then
+    expect(restrictions.call_omo_agent).toBe(false)
+  })
+
+  test("hasAgentToolRestrictions returns true for athena", () => {
+    //#given
+    //#when
+    const result = hasAgentToolRestrictions("athena")
+    //#then
+    expect(result).toBe(true)
+  })
+})