refactor(mode): drop the per-mode tool allowlist — enforce where an enforcer exists

A ModeDefinition is now exactly { section, access? }; unknown keys (a
tools list included) fail loud at load. What plan mode still does: the
guidance section, the exit_plan_mode visibility rule (plan only, both
soft surfaces), the access cap's bash/resolve-mode clamp, and the two
cap-derived pre-execute guards (the bash trio is withheld when no
confining executor can honor the cap; sandbox escalation is denied
while it holds). The general deny-by-default gate and the assemble
allowlist filter are gone: which tools a mode admits is an effects
question, and a hand-maintained name list mislabels it — it must track
every composed tool and rots silently as tools arrive. The dimension
returns as a consumer of effects self-declaration on tool definitions
(MCP ToolAnnotations as the template) — rationale and restart trigger
archived in the RFC's Alternatives/Deferred; the interim guidance-only
non-shell restraint is priced in Consequences.

Exiting plan is now a pure removal (the exit tool + section), which the
delta encoding CAN express: the re-recorded plan-mode fixture pins one
plan-shaped initial header snapshot plus one header-delta instead of
two snapshots.

docs/persistence-catalog.md

@@ -163,7 +163,7 @@ The session mode in force from this point on: log-only, non-surface, whole-value
 'mode/set': { mode: string }
 ```
 
-Source: [`packages/mode/mode/src/index.ts:49`](../packages/mode/mode/src/index.ts)
+Source: [`packages/mode/mode/src/index.ts:53`](../packages/mode/mode/src/index.ts)
 
 ### `prompt/*`