ATHENA_RESTRICTIONS only denied write and edit, missing call_omo_agent that the agent factory already denies. This caused 6 callers of getAgentToolRestrictions() to get incomplete restrictions.
Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
ismeth