fix(goals): route /goal through the bridge-driven loop so clients see goal progress

[samuelchanx]

Fixes #178

Problem

/goal kept the legacy backend goal mode (session/goal). Those backend-internal turns must be dropped by the per-prompt translator (skippingForeignTurn, the ghost-completed guard), so ACP clients never saw goal progress — only the goal set acknowledgement plus a few untyped leaked events that clients render as generic "Other" rows. Repro and evidence in #178.

Fix

/goal now shares the /auto bridge-driven GoalLoopDriver machinery (autoFlow()), which runs rounds through the normal runOneTurn dispatch — every round's tool calls and text stream to clients live.

• /goal <objective> starts the loop (full objective, same first-word subcommand rules as /auto)
• /goal pause|stop|resume|status — same subcommands as /auto
• /goal clear — stop alias (backend action=clear parity)
• /goal with no argument — shows status from the live driver or saved state
• Escape hatch: ZCODE_ACP_GOAL_MODE=backend restores the legacy backend goal mode
• The raw session/goal extension method is untouched (protocol-level show/state still works)

Verification

Unit: full suite green — 84 files / 1163 tests; tests/goal-slash.test.ts updated to pin the new routing (driver start, subcommands, clear alias, no-arg status, env escape hatch).

E2E against the real backend (scripts/goal-e2e-check.mjs, included — a minimal stdio ACP client that logs every session/update):

Published 0.35.2 (reproduces #178):

<- text: ✓ goal set: …
-- prompt finished: stopReason=end_turn (rounds keep running)
-- waiting for goal round activity (max 5min)...
== RESULT: 4 session/update events, 0 tool_call(s)
== FAIL: no round events reached the client (issue #178 symptom)

This branch:

<- text: 🎯 goal loop started: …
<- text: ✓ goal set: …
-- prompt finished: stopReason=end_turn (rounds keep running)
<- config_option_update, current_mode_update, agent_thought_chunk …
== RESULT: 12 session/update events
== PASS: goal round streamed to client

Note for reviewers

One UX delta vs the backend mode: the loop's objective lives in bridge state (goal-loop/state.ts), not backend goal state — so clients that render the backend goal banner read empty during a loop. The trade-off is the live progress stream, which the backend mode cannot offer (its turns are invisible by construction). Happy to also emit a typed goal-status notification if there's a preferred shape.

[samuelchanx]

Added a second commit addressing two adjacent host-config gaps found while testing in Paseo (which renders no ACP config-option picker at all):

• ZCODE_ACP_MODE — ACP-created sessions hardcoded mode: "yolo"; now a validated env override (plan/build/edit/yolo/auto, invalid → yolo). This doubles as the host-side permission-config surface: build/edit let the backend's permission requests flow to clients that support session/requestPermission.
• ZCODE_ACP_THOUGHT_LEVEL — applied once via session/setThoughtLevel after materialization; a rejected token logs and keeps the model default.

Pending-session modes/configOptions advertise the same defaults so a client's dropdown matches what create will actually use. +4 tests (38 total in session-lazy), full suite green (84 files / 1167 tests). Both knobs are plain env, e.g. Paseo's providers.zcode.env block.

[samuelchanx]

Trimmed this PR to just the goal-routing fix to keep the diff focused. Two adjacent fixes (ZCODE_ACP_MODE / ZCODE_ACP_THOUGHT_LEVEL host env knobs, and stripping the $ skill prefix for Paseo clients) are no longer part of this PR — they live on the paseo-extras branch of my fork if useful.