Permission save resources

Trap: passing an arbitrary command resource through PermissionAssertInput.save looks convenient because approval can be reused, but it persists model-controlled command grants beyond the current invocation. Fix: authorize the canonical shell resource immediately before the side effect and never place arbitrary command resources in save.