fix: return empty response for Allow decisions to preserve Claude permissions

[backnotprop]

Summary

• For PreToolUse and PermissionRequest hooks, returning an explicit permissionDecision: "allow" bypasses Claude's native permission system
• Per Claude Code docs, returning an empty {} response means "I have no objections" and lets Claude fall through to its own permission settings
• This fix ensures cupcake only intervenes with explicit responses for Block/Deny/Ask decisions, not for Allow

Verification

Verified against Claude Code 2.1.9 source (cli.js):

// At ~offset 8632185 - permission decision flow:
if($!==void 0 && $.behavior==="allow" && !A.requiresUserInteraction?.())
    k(`Hook approved tool use for ${A.name}, bypassing permission check`), L=$;
// ...
else {
    L=await Z(A,H,G,Y,Q,P)  // Normal permission check
}

• permissionDecision: "allow" → Sets behavior → "bypassing permission check"
• Empty {} → $ is undefined → Falls through to normal permission check

Test plan

• Unit tests pass (314 tests)
• Manual test: Initialize cupcake with builtins, verify Claude's native permissions still prompt user for Allow decisions

Fixes #96

🤖 Generated with Claude Code