* feat: add ask agent for read-only Q&A mode
Add a new primary 'ask' agent that answers questions and explains code
without making changes. Permissions are read-only: read, grep, glob,
list, question, webfetch, websearch, codesearch — edit, bash, and task
are denied. Migrators already had 'ask' in their known mode lists.
* fix: preserve .env read gating in ask agent, clarify read-only prompt
Address PR review feedback:
- Re-state *.env pattern map in ask agent permissions so the blanket
deny+allow doesn't bypass the default env file gating
- Update prompt to say 'this agent is read-only' instead of implying
edits are possible on request
- Add .env gating assertions to ask agent test
Marius
142f423b76