feat(setup): make the presets deliver their descriptions, and delete the mode nothing could reach

docs/ai/agent.mdmodified+1-2

Changes to docs/ai/agent.md

		⋯11 linesShow the 11 lines above this hunk@@ -12,11 +12,10 @@ A **mode** is a playbook plus the capability tiers it may draw tools from. The t
12	12	|---|---|---|
13	13	| `plan` | read | No |
14	14	| `review` | read, comment | No |
15		-| `restricted` | read | No |
16	15	| `fix-ci` | read, write, shell, git, comment | Yes, on the working branch |
17	16	| `implement` | read, write, shell, git, comment | Yes, on the working branch |
18	17
19		-`restricted` is what a run triggered by someone **without write access** gets. Public repositories accept input from anyone, so the actor is gated the same way the task is.
	18	+A run triggered by someone **without write access** never reaches a mode at all: public repositories accept input from anyone, so `checkPermission` refuses non-collaborators every agent-running command before one is chosen.
20	19
21	20	An unknown mode name raises an error rather than falling back to a default — silently landing in a permissive mode on a typo would be the worst possible failure.
22	21