dsh-sandbox-permissions-not-strictly-wider-justification-empty-fix

When DSH runs with non-default models and a session is already in danger-full-access mode, two recurring bugs surface across four tools (pwsh, bash, fs, and dsh-sandbox): an empty justification string triggers an 'invalid justification' error, or a same-level permission request is rejected as 'not strictly wider,' throwing an exception. These issues have been independently reported multiple times and reliably break session flow. This plugin introduces a two-layer defense. First, schema descriptions are updated to explicitly tell the model that same-mode retries are accepted as no-ops, reducing the tendency to emit empty fields. Second, runtime normalization logic is injected at each tool's execute or resolvePolicy entry point, silently clearing escalation parameters whenever the requested mode is not strictly wider than the current effective mode, so no exception is ever thrown. The plugin also self-heals: on every client start it verifies that patches are still intact and automatically re-applies them if a desktop update has broken the hard link. Uninstalling restores all original files from a persistent backup directory. If you frequently operate DSH in danger-full-access mode with non-default models, this plugin removes these recurring interruptions and keeps sandbox permission transitions smooth.