Grok Build fixes permission, tool-safety bugs

This is unglamorous but essential agent infrastructure work: permission systems are only trustworthy when every tool follows the same authorization path.

• –Hook enforcement now remains visible across approval modes, reducing the risk of silent policy bypasses.
• –WebSearch, WebFetch, and image generation receiving consistent rule handling matters because external access and media tools can expand an agent’s attack surface.
• –“Allow once” is the right default for ambiguous or high-impact actions, especially in repositories containing secrets or deployment credentials.
• –The update reinforces Grok Build’s move toward a serious coding-agent platform with hooks, MCP, sandboxing, and configurable permissions.