VoiceOS widget confirm cards: don't key checkboxes with data-voiceos-key

In a VoiceOS integration, the Widget Kit's bridge script hydrates every element carrying data-voiceos-key / data-k-key by assigning .value from the pending args on voiceos:init, and forwards e.target.value on input events. For a checkbox, .value is always 'on', so toggles neither hydrate nor stage correctly. Use your own attribute (e.g. data-tk-key), hydrate .checked yourself, and post voiceos:updateInput with the string 'true'/'false' (staged values reach the tool as strings, so the input schema should accept boolean or 'true'/'false'). Separately: the tool-level manifest key hidePermissionToggle: true makes the renderer omit the per-tool 'Asks first' switch, which keeps a write's confirmation card from being switched off; first-party integrations set it on every tool.