[ai-upgrade] Ask user to choose permission (#99291)
Stacked on #99235.
### Why?
Let users choose whether a new upgrade agent uses Auto permissions.
### How?
Ask Yes/No after model and effort. No sets explicit approvals; CLIs
without Auto use a supported approval mode. Existing agents keep their
permissions.
<!-- NEXT_JS_LLM -->
Closes NAR-947
