fix: make public agents (is_public=1) accessible to all users

Three changes to fix the CS agent (3490efa8) and other public agents not being
accessible to regular users:

- agents.py: include is_public=1 agents in listing query for non-admin users
- agent_chat.py: add is_public check in chat/stream permission guards
- permission_service.py: grant read+execute to all users for public agents

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/app/api/agent_chat.py

@@ -425,7 +425,7 @@ async def chat_with_agent(
     agent = db.query(Agent).filter(Agent.id == agent_id).first()
     if not agent:
         raise HTTPException(status_code=404, detail="Agent 不存在")
-    if agent.user_id and agent.user_id != current_user.id and current_user.role != "admin":
+    if agent.user_id and agent.user_id != current_user.id and current_user.role != "admin" and not agent.is_public:
         raise HTTPException(status_code=403, detail="无权访问该 Agent")
 
     # 从 Agent 配置构建 Runtime
@@ -525,7 +525,7 @@ async def chat_with_agent_stream(
     agent = db.query(Agent).filter(Agent.id == agent_id).first()
     if not agent:
         raise HTTPException(status_code=404, detail="Agent 不存在")
-    if agent.user_id and agent.user_id != current_user.id and current_user.role != "admin":
+    if agent.user_id and agent.user_id != current_user.id and current_user.role != "admin" and not agent.is_public:
         raise HTTPException(status_code=403, detail="无权访问该 Agent")
 
     wc = agent.workflow_config or {}