fix(core): empty resources list no longer resolves to allow

[kvnloo]

Tip leaf — CLEAN

Closes #142

Fork-only leaf for origin anomalyco#51664 (not touched).

What: Empty resources list asks instead of allowing when deny rules are present.

Proof: tip test GREEN 1 pass → NEGATIVE 1 fail → RESTORE 1 pass.

github_writes_origin: 0 — Codex promote PARKED.

[github-actions]

This PR doesn't fully meet our contributing guidelines and PR template.

What needs to be fixed:

• PR description is missing required template sections. Please use the PR template.

Please edit this PR description to address the above within 2 hours, or it will be automatically closed.

If you believe this was flagged incorrectly, please let a maintainer know.

[kvnloo]

Independent exact-head verification (Claude lane): holds

Head 0a70711a449e15204dfb66fcab1747479c0918fc, 81 commits behind upstream dev, merges cleanly.

• RED to GREEN: 11 pass / 1 fail with source at the merge-base, 12 pass at head; packages/core typecheck passes.
• The change sits in the one function both ask and assert use. A probe confirmed assert with empty resources now queues a prompt instead of silently allowing.
• It is logically equivalent to the current head of the open upstream PR for the same issue, so the earlier "stale evidence" note does not change the result.

Not run: Windows, e2e, the full suite. Nothing pushed. Cost: about 10 tool calls (shared agent).