fix(permissions): propagate I/O errors as 500 from delete_agent_permissions

Both remove_agent() calls now run unconditionally for maximum partial
cleanup, but any I/O error is returned as HTTP 500 instead of silently
200-ing — so the frontend's !resp.ok path fires and the operator sees a
meaningful error rather than the stale row reappearing unchanged.

Also add a clarifying comment on isStale in permissions.js explaining
that containersState is keyed from nixos-container list (which includes
stopped-but-configured containers), so a temporarily-stopped agent is
not treated as stale — only destroyed/renamed agents are absent.

frontend/packages/dashboard/src/permissions.js

@@ -122,6 +122,9 @@ function renderCapabilities(root, data) {
     // Effective caps (explicit-or-default) drive the checkboxes so
     // default-perms agents show their real grants, not blank.
     const assigned = effective[name] || assignments[name] || [];
+    // `containersState` is keyed from `nixos-container list`, which
+    // includes stopped-but-configured containers — so a temporarily-stopped
+    // agent is NOT stale. Only destroyed/renamed agents are absent here.
     const isStale = !containersState.has(name);
     const tr = el('tr', { class: 'cap-row' + (isStale ? ' perm-row-stale' : ''), 'data-agent': name });
 
@@ -226,6 +229,9 @@ function renderToolGroups(root, data) {
     // badge still keys off explicit-assignment presence.
     const assigned = effective[name] || assignments[name] || [];
     const hasExplicit = Object.prototype.hasOwnProperty.call(assignments, name);
+    // `containersState` is keyed from `nixos-container list`, which
+    // includes stopped-but-configured containers — only destroyed/renamed
+    // agents are absent.
     const isStale = !containersState.has(name);
     const tr = el('tr', { class: 'tg-row' + (isStale ? ' perm-row-stale' : ''), 'data-agent': name });