fix(cli): enforce bash deny after user config in orchestrator permissions

Instead of placing user before the orchestrator allowlist (which prevents
users from restricting allowed tools), keep user in the normal position
but add an explicit bash deny after user. This way:
- User can still deny orchestrator-allowed tools (e.g. webfetch)
- User cannot re-enable bash since the post-user deny wins via findLast

packages/opencode/src/agent/agent.ts

@@ -148,7 +148,6 @@ export namespace Agent {
         options: {},
         permission: PermissionNext.merge(
           defaults,
-          user, // kilocode_change: user before orchestrator-specific so orchestrator's deny+allowlist wins
           PermissionNext.fromConfig({
             "*": "deny",
             read: "allow",
@@ -168,6 +167,12 @@ export namespace Agent {
               [Truncate.GLOB]: "allow",
             },
           }),
+          user,
+          // kilocode_change start - enforce bash deny after user so user config cannot re-enable shell
+          PermissionNext.fromConfig({
+            bash: "deny",
+          }),
+          // kilocode_change end
         ),
         mode: "primary",
         native: true,