ci(zeph-acp): add CI guard against AcpPermissionGate::new(_, None) reintroduction

[bug-ops]

Summary

• Adds a self-testing bash CI guard, .github/scripts/check_acp_permission_gate.sh, wired into the lint-shellcheck job, that fails the build if AcpPermissionGate::new(_, None) reappears anywhere in crates/zeph-acp/src.
• A None second argument makes the gate fall back to the developer's real acp-permissions.toml instead of an isolated test path, silently persisting AllowAlways/RejectAlways decisions across unrelated test runs — the exact regression class zeph-acp: permission.rs tests write allow/reject decisions to the real, non-fixture acp-permissions.toml #6512 identified and PR fix(acp): isolate permission.rs tests from real acp-permissions.toml #6514 fixed for both terminal.rs and permission.rs. This guard keeps that fix from silently regressing.
• The guard includes an anti-rot self-test (each fixture sample scanned in its own isolated file so a regression in the detection regex is actually caught) and a method-existence sanity check (fails loudly if AcpPermissionGate::new is ever renamed, rather than silently going dead).
• Scope note: the original issue assumed PR fix(acp): isolate permission.rs tests from real acp-permissions.toml #6514 had already isolated permission.rs's test module. That assumption held by the time this PR was ready to merge (PR fix(acp): isolate permission.rs tests from real acp-permissions.toml #6514 landed on main mid-development), so this PR contains only the guard + CI wiring + CHANGELOG entry — no permission.rs changes, since fix(acp): isolate permission.rs tests from real acp-permissions.toml #6514 already covers that.

Test plan

• bash .github/scripts/check_acp_permission_gate.sh passes on the current tree (exit 0).
• Manually verified detection: reintroducing None at multiple sites (including both halves of the two multi-gate isolation tests) is correctly flagged with file:line and a fix hint; reverting restores a clean pass.
• Verified the guard passes under real GNU grep (Linux CI base image, rust:1.97.1-slim container), not just BSD/macOS grep — an earlier revision had a GNU-grep-only self-test failure caught and fixed here (-H flag).
• shellcheck clean on the new script.
• cargo nextest -p zeph-acp --features zeph-core/scheduler: 131/131 passed.
• cargo +nightly fmt --check clean.
• gitleaks protect --staged clean.

Closes #6515