Test: SDK-based `permissions` via managed settings

[joshspicer]

Refs: #327187, #327383

• anyOS
• anyOS

Complexity: 4

Authors: joshspicer

---

TODO

Use the file-based managed settings setup from #323147. Configure Shell rules for deny, ask, and allow, then start a fresh Agents session with Allow All enabled.

• A denied command is blocked without prompting.
• An ask command offers only Allow Once and Skip. Repeating it prompts again.
• An allowed command runs automatically.
• Agent Host logs show the managed-settings source and enforcement events.