Fix 'allow always' patterns matching paths in bash/grep commands

[yogthos]

Reported scenario

```
[permission] bash: cd /Users/yogthos/src/work/rigging-workshop
(y) allow once (a) allow always (n) deny (ESC) abort
-> will allow: cd *
allowed bash cd * (saved to session)
◈ bash "cd /Users/yogthos/src/work/rigging-workshop && git diff"
[permission] bash: cd /Users/yogthos/src/work/rigging-workshop <-- re-prompts!
(y) allow once (a) allow always (n) deny (ESC) abort
-> will allow: cd *
```

Root cause

`glob_to_regex` compiled `` to `[^/]` for all patterns — classic filesystem-glob semantics where `` doesn't cross slashes. For shell commands like `cd /Users/...` the regex `^cd [^/]$` rejects the path argument, so the session-allowlist entry never matched. Every subsequent command re-prompted.

Fix

Split `Pattern` into two compile modes:

Constructor	`*`	`?`	Used for
`Pattern::new`	`[^/]*`	`[^/]`	path tools: read/write/edit/list_dir
`Pattern::new_command`	`.*`	`.`	bash, grep, find_files, write_todo_list, ...

A `pattern_for_tool(tool, pat)` helper picks the right variant based on `is_path_tool_name(tool)`. Wired through `PermissionChecker::new` (config rules + default bash rules), `add_session_allowlist`, and `load_session_allowlist`. External-directory rules retain path semantics since they're explicitly path patterns.

What stays the same

• `src/*` (path) still matches `src/main.rs` and not `src/agent/main.rs` — one segment only.
• `src/**` (path) still spans directories.
• Static config rules retain whatever semantics map to their tool.

What changes

• `cd *` (bash) now matches `cd /any/path`, `cd /any/path && git diff`, etc.
• `grep TODO*` matches commands beyond a single segment.
• The fix is broader-permissive: nothing that previously matched now fails to match; some previously-too-restrictive matches now succeed.

Test coverage

11 new tests covering:

• The exact bug scenario (full session-allowlist roundtrip via `PermissionChecker::check`).
• `cd *` anchored at start (doesn't match `echo cd /foo`).
• Path patterns retain one-segment / recursive semantics.
• `?` differs across modes.
• `~/foo` expansion works in both modes.
• Regex metachars (`()`, etc.) are escaped, not interpreted.
• `load_session_allowlist` preserves command semantics across reload.

Test plan

• `cargo build`
• `cargo test --bin dirge -- --skip plugin` → 266 passed, 0 failed
• Manual: `allow always` on a `cd /foo` command, run a second `cd /bar`, observe no re-prompt