Three changes to fix the CS agent (3490efa8) and other public agents not being
accessible to regular users:
- agents.py: include is_public=1 agents in listing query for non-admin users
- agent_chat.py: add is_public check in chat/stream permission guards
- permission_service.py: grant read+execute to all users for public agents
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>