Allow 'cd + git' commands without security prompt when inside additionalDirectories

## Problem

When working across multiple related repos configured in `additionalDirectories`, compound commands like `cd ../sister-repo && git push` trigger a blocking security prompt:

> This command changes directory before running git, which can execute untrusted hooks from the target directory. Approve only if you trust it.

This fires **even when**:
1. The target directory is listed in `additionalDirectories` (explicitly trusted)
2. The `Bash(cd * && *)` allow rule is in the project settings
3. A `bypassPermissions` mode is set

The security check appears to bypass the allow list entirely for this specific pattern.

## Why this is painful

Multi-repo projects are a first-class use case (e.g. monorepo adjacents, sister repos). When a project uses `additionalDirectories` to declare trusted repos, `cd repo && git ` is a routine operation that should not require per-invocation approval. The current behavior forces users to either:
- Accept a blanket `bypassPermissions` (too broad), or
- Get prompted on every single cross-repo git operation

## Suggested fix

When the `cd` target resolves to a path inside `additionalDirectories` (or the project directory itself), skip the security warning for the subsequent `git` command — the directory is already explicitly trusted by the project config.

Alternatively, allow the allow-list rule `Bash(cd * && git *)` to suppress this specific warning, since the user has already declared intent.

## Context

Raised by a team using provisioning-hub + provisioning-hub-services + foak-libraries as a three-repo system. Every cross-repo git operation prompts, which creates significant friction in an agentic workflow.

No files or tests are identified. Start by tracing the security check for `cd ... && git ...` and resolution of `additionalDirectories`; reproduce the prompt with a trusted target and an untrusted target, and consider the work complete when trusted targets avoid the warning without weakening protection elsewhere.

Vom Indexierungsmodell aus dem Issue-Text verfasst.