JSONL session logs should record permission prompt events

JSONL session log files do not distinguish between "command was auto-allowed by settings.json" and "user was prompted and clicked Allow". Both produce identical tool_result entries with is_error: false.

Request: Add a field (e.g., "prompted": true or "permissionAction": "user_approved") to tool_result entries that were user-prompted.

Use case: Audit scripts that scan JSONL files to identify permission patterns for settings.json tuning. Currently only rejections and hook denials are detectable — the most useful category (approved prompts → candidates for allow list) is invisible.

Timing heuristics were tested but have ~97% false positive rate (p50 delay in bypass sessions