fix(athena): add call_omo_agent to ATHENA_RESTRICTIONS for consistent tool denial

ATHENA_RESTRICTIONS only denied write and edit, missing call_omo_agent that the agent factory already denies. This caused 6 callers of getAgentToolRestrictions() to get incomplete restrictions.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

src/shared/agent-tool-restrictions.ts

@@ -16,7 +16,7 @@ const EXPLORATION_AGENT_DENYLIST: Record<string, boolean> = {
 }
 
 const ATHENA_RESTRICTIONS = permissionToToolBooleans(
-  createAgentToolRestrictions(["write", "edit"]).permission
+  createAgentToolRestrictions(["write", "edit", "call_omo_agent"]).permission
 )
 
 const AGENT_RESTRICTIONS: Record<string, Record<string, boolean>> = {