[BUG] blockReadsOutsideWorkingDirectories prompts for allowlisted gh commands: flag values misidentified as runtime-computed paths

## Environment
- Claude Code 2.1.258, macOS (darwin)
- defaultMode: auto
- permissions.blockReadsOutsideWorkingDirectories: true
- permissions.allow includes (among others):
- "Bash(gh pr view *)"
- "Bash(gh api:*)"
- "Bash(grep:*)", "Bash(head:*)"

## Steps to reproduce
1. Set blockReadsOutsideWorkingDirectories: true and add an explicit allow rule for gh, e.g. "Bash(gh pr view *)".
2. Ask Claude to run a gh command whose arguments are a PR number, an --repo slug and a --jq expression, e.g.:

gh pr view XXXX --repo org/repo --json reviews --jq '.reviews[] | "\"\(.submittedAt[0:10]) \(.state) \(.author.login)\""'

## Actual result
A permission prompt fires with the message:

> gh names a path that is computed at run time, which cannot be checked against the read block (permissions.blockReadsOutsideWorkingDirectories)

The prompt appears even though the command is covered by an explicit user-configured allow rule. The user must confirm every such gh invocation manually.

## Expected result
Either of:
- an explicit allow rule (Bash(gh ...) or Bash(gh api:*)) should satisfy the read-block gate for that command, or
- the read-block pre-check should not classify gh flag values (--repo slug, --jq expressions, URLs) as runtime-computed file paths — they are network/URL arguments, not paths under cwd.

## Additional notes
- The heuristic is inconsistent: some gh invocations that also carry --repo/--jq pass without a prompt, others trip it. It looks like a token-level heuristic misfiring on certain strings (quotes, brackets, slashes in flag values).
- Related behavior observed in the same session: after the user manually declines a specific command once, an identical command re-prompts on later invocations even when an allow rule matches. If that is by design it would be worth documenting, since combined with the above it produces repeated unavoidable prompts.
- Practical impact: with blockReadsOutsideWorkingDirectories enabled, gh/api-heavy workflows become unusable without answering prompts, which defeats the purpose of a configured allowlist.

Happy to provide more config details if useful.

Reproduce with permissions.blockReadsOutsideWorkingDirectories enabled and an allow rule such as Bash(gh pr view *), using the reported gh pr view command with --repo and --jq values. Trace the read-block pre-check and command-argument classification; done means covered gh invocations no longer receive false path prompts while genuine outside-working-directory reads remain checked.

由索引模型根据 Issue 内容生成。