Assert the review launch's flag list whole, and say why it moves

The MultiEdit deny rule was already dropped in the hotfix; this is task
10's follow-up half — the guard that catches the next fossil.

The claude adapter's review branch spells "cannot edit files" in the
vendor's own tool names, and that roster moves: a rule naming a tool the
installed CLI does not have is refused at startup, so the launch dies
before the agent speaks. Membership assertions could not see that
happening, so the stub-binary test now asserts each mode's flag list
literally (settings payload elided) — a deny name added or renamed shows
up as a diff a reviewer must re-verify against the installed CLI. The
run script carries the same warning where the list actually lives.

The helper drops a leaked AGENT_MODEL, since --model would otherwise
appear in an argv now compared whole; test_agent_model.py owns that flag.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

manager/core/adapters/claude/run

@@ -35,6 +35,14 @@ if [ -n "${AGENT_MODEL:-}" ]; then
 fi
 
 if [ "$MODE" = "review" ]; then
+  # "Cannot edit files" has to be spelled in the vendor's own tool names,
+  # and that roster moves under us: a deny rule naming a tool the
+  # installed CLI does not have is refused outright ("matches no known
+  # tool"), so the launch dies before the agent speaks — which is how the
+  # retired MultiEdit killed every review and relevance launch (task 10).
+  # Re-check these names against the installed CLI rather than memory
+  # whenever the list is touched; tests/test_adapter_permissions.py
+  # asserts the flag list whole so any edit surfaces in review.
   exec "$BIN" -p "$AGENT_PROMPT" --settings "$SETTINGS" \
     ${MODEL_ARGS[@]+"${MODEL_ARGS[@]}"} \
     --permission-mode default \