test: close the coverage gaps on the permission line

Two real branches gain assertions (effectivePermissionPreset's backward
scan over non-preset events; the popup options() throw when the projection
vanished between availability and open — a sync throw, not a rejection).
The empty ui-permission node half joins the ui-model entry on the
client-lane coverage debt list (same pure-UI plugin shape, same TODO).

packages/ui/permission/tests/permission.spec.ts

@@ -34,6 +34,9 @@ describe('effectivePermissionPreset', () => {
     session.append('permission/preset', { preset: 'danger-full-access' })
     session.append('permission/preset', { preset: 'workspace-write' })
     expect(effectivePermissionPreset(session.events)).toBe('workspace-write')
+    // The backward scan steps over non-preset events to the latest selection.
+    session.append('sandbox/mode', { mode: 'read-only' })
+    expect(effectivePermissionPreset(session.events)).toBe('workspace-write')
   })
 })