Pass the permission ask port through the native register Config

Why: Squad members must reach the host's HITL verdict when a kernel
hook answers ask - the new native GateOptions.PermissionAsk field
carries it; nil preserves the legacy ask=reject behavior.

Evidence: go vet clean in all five modules; go test ok everywhere.

Impact: Additive Config field plus its buildOptions mapping.

adapters/native/register.go

@@ -47,6 +47,9 @@ type Config struct {
 	Trace             func(name string, attrs map[string]string) func()
 	CodeOrchestration bool
 	Ask               func(ctx context.Context, question string) (string, error)
+	// PermissionAsk 把内核钩子的 ask 决策转交宿主裁决（nil = 内核保持
+	// ask 按拒绝处理的旧行为）。经 nativexec.GateOptions 透传。
+	PermissionAsk func(ctx context.Context, call llm.ToolCall) runtime.AskVerdict
 }
 
 // Register 把 "agent-native" 工厂注册进解析器。
@@ -92,7 +95,7 @@ func buildOptions(cfg Config, role squad.RoleSpec) (nativexec.Options, error) {
 		GateOptions: nativexec.GateOptions{
 			BeforeTool: cfg.BeforeTool, AfterTool: cfg.AfterTool, Stop: cfg.Stop,
 			Reminders: cfg.Reminders, RepeatGuard: cfg.RepeatGuard, Hooks: cfg.Hooks,
-			Ask: cfg.Ask,
+			Ask: cfg.Ask, PermissionAsk: cfg.PermissionAsk,
 		},
 	}
 	if cfg.Client != nil {