Agent surface lane: trusted-extension toggle

[omridevk]

Parent

#579

What to build

Per-extension trust, persisted and surfaced in settings: third-party extension procedures always ask — their self-declared readonly is ignored — until the user marks the extension trusted, after which readonly is honored like first-party. The catalog consumes the trust set live (trust change takes effect without restart). Coordinates with the settings lane (#572) for the surface.

Spec: docs/superpowers/specs/2026-08-22-agent-api-surface-design.md (gate policy — trust tier).

Acceptance criteria

• Untrusted third-party readonly procedure asks; trusted passes; first-party unaffected
• Trust persisted per extension; revocation takes effect immediately
• Settings surface lists extensions with their trust state

Blocked by

• Agent surface lane: gate core #583 (gate core)
• coordinates with Widget user settings: layered global + project config with settings panel #572 (settings lane) for the UI surface