feat(cli): deny Question tool in CLI run mode

In CLI run mode there is no TUI to answer questions, so the Question
tool would hang forever. This sets OPENCODE_CLI_RUN_MODE env var in
runner.ts and config-handler uses it to set question permission to
deny for sisyphus, hephaestus, and prometheus agents.

src/cli/run/runner.ts

@@ -77,6 +77,10 @@ export const resolveRunAgent = (
 }
 
 export async function run(options: RunOptions): Promise<number> {
+  // Set CLI run mode environment variable before any config loading
+  // This signals to config-handler to deny Question tool (no TUI to answer)
+  process.env.OPENCODE_CLI_RUN_MODE = "true"
+
   const {
     message,
     directory = process.cwd(),