fix: approve every launcher-injected MCP server under protected Full access

[zfy0701]

Problem

Protected Full access answers MCP tool approvals itself: every granular approval
category is disabled, so no client is ever asked. It approved only ACP-injected
servers whose config carries a url, so a launcher that injects its own bridge
over stdio had every call to that bridge cancelled with
user cancelled MCP tool call, and no approval ever reached the launcher.

The same call succeeds in agent and read-only, which forward the approval to
the ACP client; it failed only in the mode meant to be the most permissive.

Change

Drop the transport condition. Every server the launcher injected through
session/new, session/load or session/fork is approved on any transport,
under the guards #4 already had:

• a name that any Codex config layer or the adapter's own config also declares
  is never approved, so session config cannot borrow a launcher-injected name;
• changing mode revokes pending approvals;
• already-loaded resumes are excluded.

Only the launcher can put a server on the injected list, so the list is already
the provenance proof. Transport added nothing to it.

fullAccessHttpMcpServers is renamed to fullAccessApprovedMcpServers, since it
no longer holds only HTTP servers. readme-dev.md is updated, including the
sentence that said stdio servers receive no automatic approval.

One behaviour change to be aware of: any other stdio server the launcher injects
(an operator's own MCP servers, for example) is approved under Full access as
well. Other modes still forward those approvals to the client.

Verification

• npm run typecheck clean.
• vitest run src/__tests__/PermissionLifecycleContext.test.ts src/__tests__/CodexACPAgent/CodexAcpClient.test.ts: 118 passed. The full suite was not run locally.
• New client-level case: a stdio bridge and an HTTP server are both approved; a
  name a config layer declares is not.
• Negative control: with the url condition restored, the new case fails with
  expected [ 'assigned' ] to deeply equal [ 'bridge', 'assigned' ], which is
  the reported bug.

Fixes agentconnect-md/agentconnect#2151. Supersedes #5: same outcome without a
per-launch secret, because the config-layer name guard already refuses a
borrowed name.

🤖 Generated with Claude Code