feat(onboarding): configure default agent permissions

[musnows]

Summary

• Add a default Agent permission selector to the first-run setup guide.
• Persist the selected permission mode into Kun runtime approval and sandbox settings.
• Warn users that Full access runs tools without asking and has full local access.

Changes

• Reuse the shared Kun tool permission modes so onboarding lists every current option.
• Preserve saved permission mode when reopening onboarding and keep provider selection behavior unchanged.
• Add Chinese and English setup copy plus coverage for the saved permission mapping.

Tests

• npm run test -- src/renderer/src/components/initial-setup-save.test.ts
• npm run typecheck
• git diff --check