fix(web_tools): remove WebFetch/WebSearch from permissions.deny

The deny list takes precedence over --allowedTools, so granting the
web_tools group had no effect — both tools were silently blocked.

WebFetch/WebSearch are now gated solely via --tools (builtin_tools_arg):
agents without the web_tools tool group don't get them in --tools so
claude never sees them; agents with the group get them in both --tools
and --allowedTools.

hive-ag3nt/prompts/claude-settings.json

@@ -3,6 +3,6 @@
   "autoMemoryEnabled": false,
   "effortLevel": "medium",
   "permissions": {
-    "deny": ["Bash", "WebFetch", "WebSearch", "Task", "TodoWrite"]
+    "deny": ["Bash", "Task", "TodoWrite"]
   }
 }