Schema mode: a headless permission auto-reject ends the run without a corrective turn #135

Observed in live verification of #134. In headless aictrl run --output-schema, when the agent requests a tool call that the permission layer auto-rejects (e.g. reading outside --dir), the loop stops. The run ends structured_output: failed / missing, exit 3, without the corrective reminder that a prose-only finish gets.

This predates schema mode (any headless run stops on an auto-reject). With a schema, though, the run has an unspent repair budget and a clear contract to finish against.

Proposal: in schema mode, treat a loop that stops on a permission rejection like a prose-only finish. It counts as an attempt; the corrective turn tells the model the action was denied and asks it to return the result via StructuredOutput using what it already has (named tool choice). The budget still bounds it. Non-schema behaviour is unchanged.

Relevant for the aictrl executor (#5960 in the app repo), where deny rules on the output area and the workspace are intentional.