fix(planning): use default permission mode so MCP planning tools don't prompt

Interactive planning sessions launched with --permission-mode plan, which
gates EVERY MCP tool call regardless of --allowedTools (verified: even a
read-only mcp__claudedo__list_task_lists is denied under plan mode). So the
session prompted the user on the first CreateChildTask -- the whole point of
a planning session.

Switch BuildPlanningStartArgs/BuildPlanningResumeArgs to --permission-mode
default, which honours the allowlist. File edits stay blocked via the planning
system prompt + AllowedTools omitting Write/Edit/Bash. Resume also re-passes
--allowedTools, since the CLI does not restore it across --resume.

The earlier 'glob does not match' hypothesis was empirically falsified:
mcp__claudedo__*, the bare server name, and the explicit tool name all allow
the tool with zero permission_denials in default mode.

tests/ClaudeDo.Worker.Tests/Runner/InteractiveLaunchSpecServiceTests.cs

@@ -361,7 +361,8 @@ public sealed class InteractiveLaunchSpecServiceTests : IDisposable
         Assert.Equal(_worktreeDir, spec.Cwd);
         Assert.Equal(_claudeStubPath, spec.Exe);
         Assert.Contains("--permission-mode", spec.Args);
-        Assert.Contains("plan", spec.Args);
+        // Default mode, not plan mode -- plan mode would gate the MCP planning tools.
+        Assert.Contains("default", spec.Args);
         Assert.Equal("tok-1", spec.Env["CLAUDEDO_PLANNING_TOKEN"]);
         Assert.Equal("20000", spec.Env["MAX_THINKING_TOKENS"]);
     }
@@ -375,7 +376,11 @@ public sealed class InteractiveLaunchSpecServiceTests : IDisposable
 
         var spec = BuildService().BuildPlanningResume(ctx);
 
-        Assert.Equal(new[] { "--permission-mode", "plan", "--resume", "sess-42" }, spec.Args);
+        Assert.Equal("--permission-mode", spec.Args[0]);
+        Assert.Equal("default", spec.Args[1]);
+        Assert.Equal("--allowedTools", spec.Args[2]);
+        Assert.Contains("mcp__claudedo__", spec.Args[3]);
+        Assert.Equal(new[] { "--resume", "sess-42" }, spec.Args.Skip(4).ToArray());
         Assert.Equal("tok-2", spec.Env["CLAUDEDO_PLANNING_TOKEN"]);
         Assert.Equal(_worktreeDir, spec.Cwd);
     }