Bug: Permissioned tools in batched calls run out of order #4094

Summary:
When multiple tools are called in one batch and one requires permission, non-permissioned tools execute first while the permissioned tool is delayed. This changes the execution order from what the model requested and breaks assumptions about sequencing.

Steps:

1. In one turn, request tools in order: A (no permission), B (needs permission), C (no permission, expects B to have run).
2. Approve permission for B.
3. Observe execution order.

Actual:

• A runs.
• C may run before B.
• B runs only after approval.
• Effective order: A, C, B.

Expected:

• Either:
  • preserve requested order (block tools after B until B is resolved), or
  • define batched calls as parallel but expose actual order/status so the model can reason correctly.

Impact:

• Confusing for the model and user.
• Breaks dependency assumptions between tools.
• Wastes tokens as the model recovers from unexpected state.