test(acp): harden permission mode regression coverage

[maxitoon]

Summary

• Add a regression test for the bounded ACP permission-mode request timeout.
• Add positive end-to-end coverage proving an advertised non-default mode emits session/set_config_option with the expected mode value.
• Add a negative end-to-end gate proving an unadvertised mode does not emit that request.

This is intentionally complementary to #4280, which covers the production-side stable configOptions advertisement fix. The duplicate advertisement unit cases were left out of this PR.

Related issues

• Related to [Bug] Hermes ACP initializes but every managed prompt hangs until 60s timeout on Windows #4098
• Related to buzz-acp: OpenCode-backed agents hang/timeout — session/set_config_option sends Claude-only permission mode values OpenCode rejects #3729

Verification

• cargo fmt --all -- --check
• cargo test -p buzz-acp --all-targets — 671 unit tests and 9 integration tests passed
• Permission-mode tests passed across five serial repetitions before the final overlap cleanup

The subprocess tests are Unix-gated because they exercise the existing Bash/read -t ACP harness path.