Permission.Source tool context

Always construct tool permission sources as { type: "tool" as const, messageID: context.messageID, id: context.id }. Omitting or rebuilding this optional-looking value loses canonical invocation correlation; source identity must come directly from the active tool context.