feat: add permission consent prompts, drop permitted capability mask

programs/include/montauk/syscall.h

@@ -131,6 +131,17 @@ namespace montauk {
     inline int getcaps(montauk::abi::SpawnCapabilities* out) {
         return (int)syscall1(montauk::abi::SYS_GETCAPS, (uint64_t)out);
     }
+
+    // Consent agent (the desktop only; see docs/consent.md).
+    inline int consent_register() {
+        return (int)syscall0(montauk::abi::SYS_CONSENT_REGISTER);
+    }
+    inline int consent_next(montauk::abi::ConsentRequest* out) {
+        return (int)syscall1(montauk::abi::SYS_CONSENT_NEXT, (uint64_t)out);
+    }
+    inline int consent_reply(uint64_t id, int decision) {
+        return (int)syscall2(montauk::abi::SYS_CONSENT_REPLY, id, (uint64_t)decision);
+    }
     inline int chdir(const char* path) {
         return (int)syscall1(montauk::abi::SYS_CHDIR, (uint64_t)path);
     }