Permission profiles get inheritance and an org-managed enforcement file

What this changes for operators

• Enterprise operators should restructure permission policy: stop maintaining flat profile lists; build a base profile plus per-team derivations using inheritance.
• Decide where requirements.toml lives (repo-rooted, org-rooted, signed) before depending on enforcement — the distribution and trust model are not yet documented.
• Migrate off legacy profile configs; 0.134.0 rejects them with migration guidance.
• Normalize permission selection on --profile as the canonical handle; flag-soup approaches are now legacy.