Allow flow-building tools by default

[andypalmi]

Flow-building read, write and destructive tools now start as allowed for a team that has not saved its own defaults. Platform tools are unchanged: read is allowed, write and destructive still ask.

Changes to flows only touch the editor and nothing runs until the user deploys, and the agent can't deploy unless that is turned on, so the approval cards add friction without protecting anything. It also fixes the permissions looking different after moving from the build chat to the editor chat, since the choices start from the same allowed defaults instead of asking in one and not the other.

• The default is now per group. defaultToolDefaults and fallbackForToolClass take the group and return allow for flow-building, and the old read-allow, rest-ask for platform.
• A team that already saved a default keeps it, including a saved "ask". Only teams with nothing saved for a class change.
• A per-tool preference and a session grant still win over the class default, so "Ask" and "Deny" work as before.

Tests cover the new defaults, platform staying on ask, a saved ask being kept, and the legacy delete migration.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (feat/expert-send-queue@e228dc5). Learn more about missing BASE report.

Additional details and impacted files

@@                    Coverage Diff                    @@
##             feat/expert-send-queue    #8877   +/-   ##
=========================================================
  Coverage                          ?   78.54%           
=========================================================
  Files                             ?      475           
  Lines                             ?    25760           
  Branches                          ?     6857           
=========================================================
  Hits                              ?    20234           
  Misses                            ?     5526           
  Partials                          ?        0           

Flag	Coverage Δ
backend	78.54% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.