fix: honor agent rolePermissionConfig in record CRUD (#23248)

## Summary
- Agent tools were built with the agent’s `rolePermissionConfig`, but
record CRUD ignored it and re-resolved permissions from `authContext`
(app `defaultRoleId`)
- CRUD services now pass `rolePermissionConfig` through
`CommonApiContextBuilder` and the common query runner, so repository
access matches the agent role
- Workflow/chat paths already use the same role for auth and
`rolePermissionConfig`, so their behavior should be unchanged

<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/23248?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->

packages/twenty-server/src/engine/api/common/common-query-runners/common-base-query-runner.service.ts

@@ -317,11 +317,13 @@ export abstract class CommonBaseQueryRunnerService<
   ): Promise<Omit<CommonExtendedQueryRunnerContext, 'commonQueryParser'>> {
     const context = getWorkspaceContext();
 
-    const rolePermissionConfig = resolveRolePermissionConfig({
-      authContext: context.authContext,
-      userWorkspaceRoleMap: context.userWorkspaceRoleMap,
-      apiKeyRoleMap: context.apiKeyRoleMap,
-    });
+    const rolePermissionConfig =
+      queryRunnerContext.rolePermissionConfig ??
+      resolveRolePermissionConfig({
+        authContext: context.authContext,
+        userWorkspaceRoleMap: context.userWorkspaceRoleMap,
+        apiKeyRoleMap: context.apiKeyRoleMap,
+      });
 
     if (!rolePermissionConfig) {
       throw new CommonQueryRunnerException(

packages/twenty-server/src/engine/api/common/types/common-base-query-runner-context.type.ts

@@ -3,6 +3,7 @@ import { type FlatEntityMaps } from 'src/engine/metadata-modules/flat-entity/typ
 import { type FlatFieldMetadata } from 'src/engine/metadata-modules/flat-field-metadata/types/flat-field-metadata.type';
 import { type FlatIndexMetadata } from 'src/engine/metadata-modules/flat-index-metadata/types/flat-index-metadata.type';
 import { type FlatObjectMetadata } from 'src/engine/metadata-modules/flat-object-metadata/types/flat-object-metadata.type';
+import { type RolePermissionConfig } from 'src/engine/twenty-orm/types/role-permission-config';
 
 export type CommonBaseQueryRunnerContext = {
   authContext: WorkspaceAuthContext;
@@ -11,4 +12,5 @@ export type CommonBaseQueryRunnerContext = {
   flatFieldMetadataMaps: FlatEntityMaps<FlatFieldMetadata>;
   flatIndexMaps?: FlatEntityMaps<FlatIndexMetadata>;
   objectIdByNameSingular: Record<string, string>;
+  rolePermissionConfig?: RolePermissionConfig;
 };