feat(cloud): Add plan mode support for cloud runs

[VojtechBartos]

Problem

Plan mode doesn't work in cloud runs. The cloud agent auto-approves all permission requests, so when an agent calls ExitPlanMode, the plan is instantly approved without any human review. The agent skips planning and jumps straight to making changes. There's also no way to switch modes (plan/default/accept edits/bypass) from the desktop app when watching a cloud run.

Prerequisite

PostHog/posthog#54466

Solution

• Permission relay: When a desktop app is connected to a cloud run, permission requests (plan approvals, edit/bash approvals) are relayed to the desktop via SSE instead of being auto-approved. The user reviews and approves/rejects from the same UI as local sessions.
• Plan mode enforcement: Cloud runs now route permission checks through the same handler as local sessions, so plan mode restrictions (denying write/bash tools until the agent writes a plan and calls ExitPlanMode) are enforced in cloud too.
• Initial mode passthrough: The permission mode selected in the desktop app (e.g., "plan") is passed through the API to the cloud sandbox so the agent starts in the correct mode.
• Cloud mode switcher: Cloud sessions now show the mode selector in the chat UI, allowing users to cycle between modes (shift+tab) including bypass permissions (always available for cloud since it runs in an
  isolated sandbox).
• Background/web-app safety: Cloud runs without initial_permission_mode default to bypassPermissions so tasks started from the web app or Slack continue to auto-approve without blocking.

Showcase

code-plan-mode.mov