test(cli): align ACP fixture contracts

[kitlangton]

Why

The ACP permission and form behavior tests fail deterministically on both Linux and Windows because their local HTTP fixture still models the previous request contracts. Permission replies are rejected with HTTP 400, while unsupported forms are never cancelled and time out.

What Changes

Request	Before	After
Permission reply body	Reads reply	Reads decision
Form cancellation	Matches POST .../cancel	Matches DELETE .../form/:id

The fixture and its request assertions now match the generated client used by the production ACP implementation.

Scope

This PR only updates the ACP test fixture and its request reader. It does not change runtime behavior or public APIs.

Verification

cd packages/cli
for i in 1 2 3; do bun run test test/acp/permission-behavior.test.ts test/acp/event-behavior.test.ts || exit 1; done
bun typecheck

cd ../..
bun run check

• Focused ACP suite: 19 passed, 0 failed on three consecutive runs
• CLI typecheck: passed
• Repository lint and typecheck: passed