with_default_highlights expects non-overlapping sorted ranges. The
whole-range color highlight overlapped with the code span highlights,
causing 'invalid text run' panic. Set text color on parent div instead.

with_default_highlights captures the text style eagerly at call time,
before the parent div's .text_color() takes effect during layout.
Switch to with_highlights which defers to layout time, so the text
color set on the parent div is properly inherited.

- Add global default permission mode to tool_permissions settings
- Change per-tool default_mode to optional default (falls back to global)
- Change ToolPermissionContext inputs from single string to Vec<String>
- Add settings migration (m_2026_02_04) for old → new schema
- Add restore_file_from_disk tool permission support
- Remove always_allow_tool_actions setting
- Add global default mode selector to settings UI
- Update documentation

- Create dedicated docs/src/ai/tool-permissions.md reference page
- Add cross-links from SUMMARY, overview, privacy-and-security, agent-panel, mcp
- Simplify inline tool permissions docs in agent-settings.md (link to new page)
- Add restore_file_from_disk, save_file, subagent to tools.md
- Fix model name (gpt-5-mini), font size setting name (agent_ui_font_size),
  single_file_review default (true), model_parameters JSON wrapping
- Clarify that per-tool regex patterns only apply to native Zed agent
- Add doc comments on ToolPermissions::default field

- Reject empty regex patterns in compile_regex_rules (security fix)
- Expand tool permissions documentation (agent-settings.md, agent-panel.md, mcp.md)
- Update settings content doc comments and default.json comments
- Add tests: empty regex validation, default.json parsing, explicit global default, precedence
- Replace .ok()/let _ = with .log_err() in visual_test_runner.rs
- Add doc comments on HardcodedSecurityRules and clarifying test comments

…laude Code and Codex

When always_allow_tool_actions was true, also set:
- agent_servers.claude.default_mode = "bypassPermissions"
- agent_servers.codex.default_mode = "full-access"

This preserves the auto-accept behavior for ACP agents that was
previously provided by always_allow_tool_actions. Without this,
users who had always_allow_tool_actions: true would be prompted for
every ACP agent tool call after the migration, since the new
tool_permissions.default setting only applies to Zed's built-in agent.

Replace convoluted std::mem::take + unwrap_or_default + unreachable!
pattern with direct pattern matching. Drop the entry API in favor of
a matches! check for absent/null followed by get_mut, making the flow
linear and eliminating the intermediate null insertion.

…chema-redesign

The migrate_tool_permission_defaults migration no longer touches
agent_servers, so remove agent_servers from expected test outputs
where it wasn't in the input, and update comments accordingly.