pty_write fragmented authorization

Trap: permission: "shell" on pty_write or pty_kill looks like authorization, but tool permission metadata only filters catalog definitions; ownership checks also provide isolation, not consent. Fix: call canonical ctx.permission.assert immediately before each mutation using the active tool source. Never authorize reconstructed write fragments as shell commands because fragments can combine into denied commands.