Effect plugin domain contracts and Permission.assert bridge

Effect plugin domains must extend their corresponding interfaces from @opencode/client/effect/api, never redefine inherited operations, and add only plugin-context capabilities. Expose canonical authorization as permission.assert on the Effect and Promise plugin domains without adding a Protocol/Server endpoint. Bind it directly to Core Permission.Service.assert in the host and adapt it with run(...) so saved grants, hooks, approvals, decline semantics, defects, and canonical sources remain intact. Keep a real-host Promise-plugin regression test.