fix(tui): remediate permission audit findings on delete scope, edit consent, MCP claims, and Spanish structural summary

[DannyBaanks]

Summary

This PR addresses all 4 security and UX findings reported in the Amp TUI permission audit screenshot:

1. Delete scope isolation (Un permiso "solo para B" también reactiva A):

   • In _change_session_delete_grant (src/isycode/tui_app_authority.py), scoped targets to [session_id] on enable and removed session_id on disable, preventing inadvertent reactivation of previous conversation delete grants.
   • Updated structural summary metadata to accurately reflect conversation-scoped deletion grant.

2. File editing consent description (El consentimiento de edición describe permisos distintos de los que guarda):

   • In _change_workspace_write_grant (src/isycode/tui_app_authority.py), replaced misplaced Tailscale metadata with genuine workspace authority metadata (owner="workspace authority", scope=str(self._workspace_root), duration="persistent workspace grant", not_granted="sensitive files, .isyroot, and unapproved folder writes stay off-limits").
   • Made TailscaleConfirmScreen accept dynamic structural parameters with backward-compatible defaults.

3. Accurate MCP filesystem isolation claims (MCP promete una restricción de archivos que no aplica):

   • Corrected misleading no filesystem access structural claim in LocalMCPConfirmScreen and tui_app_tools.py. Now accurately reports that the MCP server runs with the user's local process permissions (runs with user permissions (no filesystem isolation)).

4. Localization of structural summary fields (Español incompleto en información crítica):

   • Wrapped Owner, Scope, Duration, and Not granted labels and their dynamic values in tr(...) in ApprovalScreen and ReviewConsentScreen (src/isycode/tui_screens_approval.py).
   • Appended and synchronized complete message catalogs across English, Spanish (es), and Simplified Chinese (zh). Validated with validate_catalogs().

5. Security Authority Snapshot & Tests:

   • Synchronized AST line numbers in docs/security/m15-authority-coverage.json.
   • Added comprehensive regression tests in tests/test_tui_permission_audit.py covering all 4 audit points.

Verification

• pytest tests/test_tui_permission_audit.py tests/test_action_coverage.py tests/test_localization.py: 39 passed.
• python3 -c "from isycode.tui_localization import validate_catalogs; print(validate_catalogs())": 0 discrepancies.
• python3 -m compileall src/ tests/: 0 errors.
• git diff --check: 0 whitespace issues.