fix(worker): route WeekReportService permission-mode through PermissionModeResolver

Closes the last unrouted --permission-mode call site: haiku default models were
hardcoding raw "auto", which the CLI silently downgrades to interactive "default"
and hangs the report generation. Also drops the author's personal C:\Private
default exclude in favor of an empty default (config stays via ReportExcludedPaths).

src/ClaudeDo.Worker/Report/WeekReportService.cs

@@ -10,7 +10,7 @@ namespace ClaudeDo.Worker.Report;
 
 public sealed class WeekReportService
 {
-    private static readonly string[] DefaultExcludes = { @"C:\Private" };
+    private static readonly string[] DefaultExcludes = Array.Empty<string>();
     private const string NoActivity = "_No activity in this period._";
 
     private readonly IClaudeHistoryReader _reader;
@@ -72,7 +72,7 @@ public sealed class WeekReportService
             IReadOnlyList<string> args =
             [
                 "-p", "--output-format", "stream-json", "--verbose",
-                "--permission-mode", "auto",
+                "--permission-mode", PermissionModeResolver.Resolve(safeModel, "auto"),
                 "--model", safeModel,
             ];
             var result = await _claude.RunAsync(args, prompt, Path.GetTempPath(), _ => Task.CompletedTask, ct);