fix(agent-permissions): harden council_session deny list

src/agents/index.test.ts

@@ -286,6 +286,12 @@ describe('tool permissions', () => {
     const explorer = agents.find((a) => a.name === 'explorer');
     expect((explorer?.config.permission as any).council_session).toBe('deny');
   });
+
+  test('councillor is denied access to council_session', () => {
+    const agents = createAgents();
+    const councillor = agents.find((a) => a.name === 'councillor');
+    expect((councillor?.config.permission as any).council_session).toBe('deny');
+  });
 });
 
 describe('isSubagent type guard', () => {

src/agents/index.ts

@@ -117,9 +117,9 @@ function applyDefaultPermissions(
 
   // Respect explicit deny on question (councillor)
   const questionPerm = existing.question === 'deny' ? 'deny' : 'allow';
-  const councilSessionPerm =
-    existing.council_session ??
-    (COUNCIL_TOOL_ALLOWED_AGENTS.has(agent.name) ? 'allow' : 'deny');
+  const councilSessionPerm = COUNCIL_TOOL_ALLOWED_AGENTS.has(agent.name)
+    ? (existing.council_session ?? 'allow')
+    : 'deny';
 
   agent.config.permission = {
     ...existing,