fix: honor protected Full access for assigned HTTP MCP tools

[zfy0701]

Protected Full access can list ACP-assigned HTTP MCP tools but rejects unannotated calls with MCP tool call requires approval, but approval policy is never. Credential-protection rules prevent Codex from treating that filesystem profile as unrestricted.

Keep the protected profile and route native MCP tool approvals through ACP with all granular approval categories disabled. Accept once only for ACP-injected HTTP servers during the current Full access prompt; changing mode invalidates pending automatic approvals.

• Preserve native MCP configuration, explicit per-tool approval rules, stdio enforcement, and other modes' approval options.
• Keep other permission requests, server-origin elicitations, and MCP dependency installation denied in protected Full access.
• Exclude child turns and already-loaded resumes whose effective configuration cannot be verified. Native hooks report permission_mode: default under the granular policy.

Validation: typecheck, build, and the complete unit suite (547 passed, 26 skipped; retries disabled). Add three regression cases to existing test files for scoped approvals, preserved refusals, and the mode-downgrade startup race. A separate local fixture previously verified this unchanged production code with real Codex 0.153.3/0.153.4, including mode switching and forged server elicitation metadata, without credentials or paid model calls. The fixture is outside this PR; CI files are unchanged.

Fixes agentconnect-md/agentconnect#1831. Targets the maintained agentconnect/rebase-v1.10.0 release branch; publishing the scoped package and updating AgentConnect's runtime pin follow separately.

Created by Codex . GPT-6