Completes PAP-659 plan steps C0/C1/C2 and C6/C7 on this worktree.
- Fold the key step's own Advanced settings into the same disclosure that
holds the access controls, so every connector has exactly one Advanced in
the same place rather than two on one screen.
- Keep the disclosure open when what is inside it is load-bearing: a
non-default method in use, or a selection the connector still needs.
- Restore first-attempt vs retry semantics on the single primary action: the
first press creates or resumes, and only a retry pays for the defensive
re-read that recovers a create whose response was lost.
- Show the resolved default on the one-time Cloud enrolment screen too, and
state every reason the default cannot apply rather than only the first.
- Show a loading state when a deep link arrives before the gallery resolves
its definition; the deleted Access step used to carry that wait.
- C6a: recommendedDefaultsForApp now returns
askFirstRiskLevels ["write","destructive","high","critical"] instead of [],
arming the approval gate that was already built but had nothing behind it.
- C6b/C7: the Permissions tab gains a per-group bulk control and shows each
action's risk level, so a tool the classifier misfiled is visible.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
