[copyberry]

Bind permission grants to the originating turn

Why

Background code-mode cells can continue running after a new turn starts. Looking up grants and strict review requirements through the active turn can make those cells lose their approved access or use another turn's permissions.

What changed

• Keep turn-scoped grants and strict review state in TurnContext, retained by captured steps and background cells.
• Record permission responses against the requesting turn, including requests made after a later turn starts.
• Share live session-scoped grants across turns while keeping turn-scoped grants isolated.
• Use the originating turn's permissions and review requirements for tool execution, patches, MCP calls, file uploads, and terminal input.

Testing

Add regression coverage for background cells retaining grants across turn changes, turn versus session scope, permission requests after the next turn starts, and strict review enabled while write_stdin is queued.