feat(security): bash command security + auto-allow hardening

[nnemirovsky]

Summary

• Harden Bash command matching by splitting compound commands and matching each segment independently, mirroring Claude Code's splitCommand() approach. Deny on ANY segment, allow requires ALL segments covered.
• Auto-allow read-only Bash commands (cat, head, tail, ls, etc.) with path validation. Absolute paths must be inside cwd or allowed dirs. Blocks traversal (../), tilde expansion (~/, ~user), and redirects (>, <).
• Auto-allow Agent, Skill, Glob, and WebSearch as internal tools (explicit allow, not passthrough). No more native permission prompts for these.
• Anchor overlay-proposed Bash regexes with CC's safe character class to prevent compound command injection.
• Support allowed_dirs in passthru.json schema. Bootstrap imports CC's additionalAllowedWorkingDirs.
• Add overlay queue lock so concurrent permission prompts serialize instead of falling through to CC's native dialog.
• Send OSC 777 desktop notification before overlay prompt (works in Ghostty, iTerm2).

Test plan

• 855 bats tests pass (up from 749 baseline, +106 new)
• 5-agent comprehensive review (quality, implementation, testing, simplification, documentation)
• Code smells review
• 5 iterations of adversarial codex review catching 10+ security bypasses (redirect stripping, path traversal, tilde expansion, bash 3.2 compat, find -fprint, quote-aware splitting)
• Critical-only final review pass: clean
• Manual: test overlay dialog with compound Bash command
• Manual: test Agent/Skill/WebSearch no longer show CC native prompt
• Manual: test cat src/file.txt auto-allows, cat /etc/passwd does not
• Manual: test concurrent permission prompts queue through overlay
• Manual: verify Ghostty notification on overlay prompt