fix(computer-use): check permissions before opening target apps

[memory-lee]

The native get_app_state path can launch an application while resolving it, before checking Accessibility access. Handling only the resulting permission error therefore opened both the target app and System Settings on a first attempt.

Check native permissions before dispatching any tool to the local macOS open_computer_use server. The diagnostic uses the same configured launcher, prefix arguments, environment and working directory as MCP, replacing only the final mcp argument with doctor. The target application is never passed to the diagnostic. Missing access opens permission guidance and blocks Computer Use calls for that turn; a new user message triggers a fresh check. Unknown diagnostics fail closed, and cancellation during the check prevents dispatch. Linux, Windows and unrelated MCP servers retain their existing behavior.

All tools on a connection share the turn check, including concurrent calls. A native permission failure after preflight also blocks subsequent Computer Use calls in that turn. Tool responses tell the agent to end the turn and avoid alternative executors; this change does not add a global execution guard to browser or shell tools.

Validation: 68 related tests passed across the focused MCP/permission suites and Computer History regressions. Coverage includes zero target calls on denied/unknown access, same-turn blocking after simulated authorization, fresh checks on a new message, concurrency, chat isolation, cancellation, and wiring through actual MCP registration. The bundled macOS 0.3.5 native diagnostic returned a verified granted status without invoking a target application. TypeScript checks, Agent build and diff checks passed. Denied-permission scenarios used fixtures; no existing OS grants were revoked or changed. Clean-machine signed-installer first-grant acceptance remains outstanding.