fix(permissions): mark stale agents and allow removing their explicit entries

The P3RM1SS10NS tab showed agents that no longer exist in the live
container roster — e.g. an agent named 'root' that was renamed or
destroyed but still had explicit entries in tool-groups.json and/or
capabilities.json. The roster-union behaviour is intentional for
temporarily-stopped agents, but stale entries from renamed/destroyed
agents are confusing.

Backend (dashboard/permissions.rs):
- New DELETE /api/permissions/{agent} handler that bypasses the live-
  roster guard (intentionally — that's the point). Calls
  tool_groups::remove_agent + capabilities::remove_agent to clear both
  JSON files, then emits live SSE snapshots so the tab updates without
  a page reload. Format-checks the agent name but does not require it to
  be in the containers snapshot.

Frontend (permissions.js):
- renderCapabilities / renderToolGroups now cross-reference agentNames
  against containersState (the live roster, already imported). Agents
  not in the live roster get an isStale flag.
- Stale rows get a '(not running)' label and a '✕ remove' button that
  calls clearStaleAgent() — a new async helper that DELETEs the stale
  entry and re-fetches both perm tables.
- Non-stale agents without explicit assignments still get '(default)'.

CSS (dashboard.css):
- .perm-row-stale (reduced opacity), .perm-stale-label (muted small
  text), .perm-remove-btn (small red-bordered button) + disabled state.

frontend/packages/dashboard/src/dashboard.css

@@ -902,6 +902,28 @@ footer .banner-thin {
 }
 .perm-save-err { color: var(--red); }
 
+/* Stale permission entry (agent not in the live roster) */
+.perm-row-stale td { opacity: 0.7; }
+.perm-stale-label {
+  font-size: 0.75em;
+  color: var(--muted);
+  margin-left: 0.4em;
+}
+.perm-remove-btn {
+  margin-left: 0.5em;
+  padding: 0.05em 0.5em;
+  font-size: 0.75em;
+  color: var(--red);
+  background: transparent;
+  border: 1px solid currentColor;
+  border-radius: 3px;
+  cursor: pointer;
+  font-family: inherit;
+  opacity: 0.8;
+}
+.perm-remove-btn:hover { opacity: 1; }
+.perm-remove-btn:disabled { opacity: 0.4; cursor: not-allowed; }
+
 /* ─── scheduled prompts tab ────────────────────────────────────────
    Creation form at the top, list of queued schedule cards below. */