permission: SEMVER-MAJOR ceiling for Worker explicit execArgv

Breaking change: when the parent has the Permission Model enabled, a Worker
with explicit execArgv (including []) cannot obtain wider permission-related
grants than the parent.

- Unconfigured worker permission flags → parent grant ceiling
- Configured flags → intersect booleans; fs lists subset of parent
  (empty worker fs list keeps parent list; prefix-aware path coverage)
- Options only; runtime FSPermission unchanged
- Document behavior in permissions and worker_threads APIs

Signed-off-by: yunshingng <yunshingng25@gmail.com>

Author: yunshingng

doc/api/permissions.md

@@ -28,6 +28,15 @@ If you find a potential security vulnerability, please refer to our
 
 ### Permission Model
 
+<!-- worker-execargv-permission-ceiling -->
+When the Permission Model is enabled in the parent process, creating a
+`worker_threads.Worker` with an explicit `execArgv` option (including an empty
+array) no longer allows the worker to obtain a wider permission-related grant
+set than the parent. Permission-related grants on the worker are limited to a
+subset of the parent's grants. Non-permission `execArgv` flags are unaffected.
+This is a breaking change relative to earlier releases where `execArgv: []`
+could drop the parent's Permission Model grants.
+
 <!-- YAML
 added: v20.0.0
 changes:

doc/api/worker_threads.md

@@ -1561,6 +1561,12 @@ if (isMainThread) {
 
 ### `new Worker(filename[, options])`
 
+<!-- worker-execargv-permission-ceiling -->
+**Permission Model (breaking):** If the parent process runs with the
+Permission Model enabled, an explicit `execArgv` (including `[]`) does not
+disable or exceed the parent's permission-related grants. See the Permission
+Model documentation.
+
 <!-- YAML
 added: v10.5.0
 changes: