fix: Replace patch with apply_patch in EDIT_TOOLS

The tool is named apply_patch, not patch. Updating EDIT_TOOLS
to use the correct tool name so it gets filtered properly in plan mode.

Author: ariane-emory

packages/opencode/src/permission/next.ts

@@ -69,7 +69,7 @@ export namespace PermissionNext {
     return S.evaluate(permission, pattern, ...rulesets)
   }
 
-  const EDIT_TOOLS = ["edit", "write", "patch", "multiedit"]
+  const EDIT_TOOLS = ["edit", "write", "apply_patch", "multiedit"]
 
   export function disabled(tools: string[], ruleset: Ruleset): Set<string> {
     const result = new Set<string>()

packages/opencode/test/permission/next.test.ts

@@ -395,17 +395,17 @@ test("disabled - disables tool when denied", () => {
   expect(result.has("read")).toBe(false)
 })
 
-test("disabled - disables edit/write/patch/multiedit when edit denied", () => {
+test("disabled - disables edit/write/apply_patch/multiedit when edit denied", () => {
   const result = PermissionNext.disabled(
-    ["edit", "write", "patch", "multiedit", "bash"],
+    ["edit", "write", "apply_patch", "multiedit", "bash"],
     [
       { permission: "*", pattern: "*", action: "allow" },
       { permission: "edit", pattern: "*", action: "deny" },
     ],
   )
   expect(result.has("edit")).toBe(true)
   expect(result.has("write")).toBe(true)
-  expect(result.has("patch")).toBe(true)
+  expect(result.has("apply_patch")).toBe(true)
   expect(result.has("multiedit")).toBe(true)
   expect(result.has("bash")).toBe(false)
 })