feat: show permission reasons before approval - #14079

Issue

Fixes #14061

Context

Permission prompts show the requested command or filesystem scope, but do not consistently explain how that access relates to the user's task.

Implementation

Carry task descriptions through existing permission metadata and display a separate italicized Reason in the CLI and VS Code extension. Commands, paths, patterns, and approval controls remain unchanged.

Require a description in the model-facing read schema while preserving compatibility for direct calls that omit it. Missing or blank descriptions preserve existing metadata instead of substituting a generic reason. OpenCode integration uses narrow annotated hooks with Kilo-owned helpers.

Screenshots / Video

CLI and VS Code screenshots are attached above and show the verified behavior.

How to Test

Human verification

The contributor tested the rebuilt CLI and development extension with: Read C:\Windows\System32\drivers\etc\hosts and explain how localhost names are resolved. Both screenshots show a labeled, italicized task reason separate from the requested scope and approval controls.

Reviewer steps

1. Request a read outside the workspace and inspect the Reason, scope, and approval controls.
2. Request a shell command requiring approval and inspect the Reason above the command.

Agent verification and limitations

• Focused read-permission regression: 1 passed, including omitted and blank descriptions.
• Earlier focused attachment and CLI rendering checks passed; VS Code transport, recovery, localization, and component checks: 135 passed.
• Typechecks, VS Code lint, knip, compile, and OpenCode annotation checks passed during development.
• The Windows equivalent forbidden-marker check passed; the native shell command requires unavailable !/grep support.
• A broader OpenCode run timed out in three existing session scenarios (subagent exploration after a rejected read and both continue_loop_on_deny cases). Baseline comparison has not established their cause; this is not a claim that the full suite passes.

Checklist

• Issue linked above, or exception explained
• Tests/verification described
• Screenshots/video included for visual changes, or marked N/A
• Changeset considered for user-facing changes
• I personally reviewed the diff and can explain the changes, including any AI-assisted work.