Fix command-center permanent allowlist backend crash

[cursor]

Summary

• Add the missing brain.permanent_allowlist backend module used by command-center approval endpoints and orchestrator paths.
• Persist scoped permanent approval rules locally with exact payload matching and server-side rejection for never-permanent actions.
• Fix a permanent approval creation logging crash caused by passing action both positionally and as a keyword.
• Add focused regression tests for rule CRUD, matching, endpoint creation, and forbidden actions.

Validation

• python3 -m pytest tests/test_events_router.py tests/test_permanent_allowlist.py -> 10 passed
• python3 -m pytest -> 24 passed, 1 known unrelated failure in tests/test_repo_router.py::test_repo_tree_returns_empty_when_governance_root_missing
• Explicit import check for routers.events, services.supervisor_bridge, and brain.orchestrator.main passed