feat: delegation permissions — release 0.48.0

[raymondk]

What

Support the new permissions field on delegations, and cut release 0.48.0.

• ic-transport-types: add permissions: Option<DelegationPermissions> to Delegation, plus a new DelegationPermissions enum (Queries | All) describing which request kinds a signed delegation authorizes. Serializes as "queries"/"all"; omitted when None.
• ic-agent: re-export DelegationPermissions from ic_agent::identity alongside Delegation/SignedDelegation, so callers can name the type when setting the field without a direct ic-transport-types dependency.

Why

Requested by the Identity team — blocking the MCP read-only permissions feature. Matches the protocol addition in dfinity/ic#10449.

Release: 0.48.0 (minor bump)

Delegation is a public struct that is not #[non_exhaustive], so adding a field is a breaking change under SemVer (struct-literal construction now requires permissions: None). For a 0.x crate the breaking position is the minor version, so 0.47.3 → 0.48.0. The 0.48.0 number is free — the earlier 0.48.0 (rustls change, #732) was reverted before release and never published to crates.io.

Compatibility

permissions uses #[serde(default, skip_serializing_if = "Option::is_none")], so a None value is omitted from serialization and to_request_id produces the identical hash to a pre-permissions delegation. Existing signed delegations still verify unchanged; new/old wire formats deserialize interchangeably.

Changes for release

• Workspace version 0.47.3 → 0.48.0 (Cargo.toml + Cargo.lock)
• CHANGELOG.md ## [0.48.0] entry with a Breaking Changes note

Publish to crates.io via the manual Publish to crates.io workflow after merge.

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 835ca9c.

Security Overview

• 🔎 Scanned files: 6 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/a3a96bf1-e1e7-4946-9d69-cd1493c911f8?scanId=2ed29d03-bbd6-4f06-b6bc-08ca9c266e62&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► ic-agent/src/identity/mod.rs     pub use ic_transport_types::{Delegation, DelegationPermissions, SenderInfo, SignedDelegation}
Enhancement	► ic-transport-types/src/lib.rs     pub struct Delegation {      /// If present, this delegation only applies to the specified kinds of requests.      #[serde(default, skip_serializing_if = "Option::is_none")]      pub permissions: Option,     }     /// The kinds of requests a [Delegation] permits.     #[derive(Debug, Clone, Copy, Eq, PartialEq, Hash, Serialize, Deserialize)]     pub enum DelegationPermissions {      /// Only query calls and read_state requests are permitted.      #[serde(rename = "queries")]      Queries,      /// All request types are permitted.      #[serde(rename = "all")]      All,     }
Enhancement	► ref-tests/tests/integration.rs     Add permissions: None fields to several delegation initializations and usages in integration tests