refactor(permission-controller): decouple permission middleware via messenger actions

[rekmarks]

Advances #4238
Reverts #8502

• Rewrites permission-middleware.ts as a standalone createPermissionMiddleware({ messenger, subject }) factory that dispatches through the PermissionController:executeRestrictedMethod and PermissionController:hasUnrestrictedMethod messenger actions instead of bound controller hooks. Removes the createPermissionMiddleware property from PermissionController.
• Exposes hasUnrestrictedMethod as a public method / messenger action, and makes getRestrictedMethod #-private (it has no remaining external consumers now that the middleware goes through the messenger).
• When a restricted method returns undefined, the middleware now propagates the plain Error thrown by executeRestrictedMethod; the JSON-RPC engine serializes it as a standard internal error response instead of a custom internalError with a request data payload.

---

Note

Medium Risk
Breaking API change to how JSON-RPC permission enforcement middleware is created and wired, which can impact authorization behavior and downstream integrations. Adds a new JsonRpcEngineV2 middleware path and changes error propagation, so regressions would surface at runtime if consumers misconfigure messengers or rely on prior error shapes.

Overview
Permission middleware creation is now standalone and messenger-driven. PermissionController.createPermissionMiddleware is removed (breaking) and replaced by exported createPermissionMiddleware (legacy JsonRpcEngine, deprecated) and new createPermissionMiddlewareV2 for JsonRpcEngineV2, both calling PermissionController:hasUnrestrictedMethod and PermissionController:executeRestrictedMethod via a provided messenger.

Controller surface and tests/docs updated to match. hasUnrestrictedMethod is added/exposed as a public method + messenger action, restricted-method lookup is made private, docs/examples and unit tests are rewired to delegate the required actions to a scoped middleware messenger, and the undefined-result case now propagates the plain executeRestrictedMethod error (wrapped by the engine as -32603) rather than returning a custom internalError payload.

^{Reviewed by Cursor Bugbot for commit 706f8dc. Bugbot is set up for automated code reviews on this repo. Configure here.}

[rekmarks]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 706f8dc. Configure here.}