can_use_tool is a ready gate seam with subagent provenance

Every tool call the CLI wants approved arrives at Control Protocol Query as a can_use_tool request carrying tool name, input, tool_use_id, agent_id, blocked_path, decision_reason and suggested permission updates. The developer's callback can allow, rewrite the input, add permission rules, or deny with interrupt. Missing callbacks fail closed. Gaps: the context's abort signal is always None, and a CLI cancel kills the callback task without telling it.

Recommendation (small effort): Wire the CLI's control_cancel_request into ToolPermissionContext.signal and the hook context signal, so an approval waiting on a human can be withdrawn cleanly instead of being cancelled mid-await.