fix(agent-permissions): propagate DB errors instead of silently denying

safeGetAgent was catching all errors and returning null, causing every
permission check (canControlAgent / canManageOrganization / canRequestHire)
to silently deny when the database threw. Only swallow the 'Agent not found'
case and let real DB errors propagate up to registerHandle's sanitizer.

src/main/agent-permissions.ts

@@ -7,8 +7,11 @@ function safeGetAgent(db: AppDatabase, agentId: string | null | undefined) {
   }
   try {
     return db.getAgent(agentId);
-  } catch {
-    return null;
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("Agent not found:")) {
+      return null;
+    }
+    throw error;
   }
 }