refactor: replace hardcoded permission/model modes with centralized schema validation

Extract permission and model mode validation into reusable functions utilizing
@hapi/protocol schemas. Use isPermissionModeAllowedForFlavor and
isModelModeAllowedForFlavor to validate modes based on session flavor (claude/codex).
Replace inline type definitions with shared types from @hapi/protocol.

cli/src/commands/codex.ts

@@ -3,6 +3,7 @@ import { authAndSetupMachineIfNeeded } from '@/ui/auth'
 import { initializeToken } from '@/ui/tokenInit'
 import { maybeAutoStartServer } from '@/utils/autoStartServer'
 import type { CommandDefinition } from './types'
+import type { CodexPermissionMode } from '@hapi/protocol/types'
 
 export const codexCommand: CommandDefinition = {
     name: 'codex',
@@ -14,7 +15,7 @@ export const codexCommand: CommandDefinition = {
             const options: {
                 startedBy?: 'daemon' | 'terminal'
                 codexArgs?: string[]
-                permissionMode?: 'default' | 'read-only' | 'safe-yolo' | 'yolo'
+                permissionMode?: CodexPermissionMode
             } = {}
             const unknownArgs: string[] = []