[FEATURE]: Show only the specific permission rule responsible for a denied tool call

Feature hasn't been suggested before.

• I have verified this feature I'm about to request hasn't been suggested before.

Describe the enhancement you want to request

Sometimes the agent tries to run a bash command that is denied. Often that command is buried within a chain of other commands so it is not obvious which command triggered the denial. The agent then goes speculating and most often comes to the wrong conclusion.

We should only tell it the specific rule it violated that is responsible for denying the tool call and not dump the full (lengthy) list of all rules that are currently active.
"The user has specified a rule which prevents you from using this specific tool call. Here are some of the relevant rules" even implies that what follows is only the relevant subset of rules that apply to the executed command, not a just blindly dumped list of everything.

One other side effect of that which would get fixed is that it sees {"permission":"bash","pattern":"*","action":"ask"} and gets frightened to do anything.

The denial message should explain the decision that was made, not expose the entire configuration from which the decision was derived.
This way, we can help the agent fix the (bash) command and not give up frustrated.