[BUG] Cowork (Windows): every mcp__workspace__bash call denied "by rule" since Desktop 1.44121.1 / Claude Code 2.1.258 — --disallowedTools Bash now propagates to the aliased Cowork tool

## Environment
- Claude Desktop 1.44121.1 (MSIX, `C:\Program Files\WindowsApps\Claude_1.44121.1.0_x64__…`), installed 2026-09-02 15:19 local
- Bundled Claude Code 2.1.258 (`%APPDATA%\Claude\claude-code\2.1.258\claude.exe`, `cli_binary_source: required_version`), installed 2026-09-02 15:44
- Windows 11 Pro 22000, CoworkVMService running, VM status `ready`
- Previous bundle 2.1.255 worked the same day (session 12:08: 16 successful bash calls)

## Symptom
Since 2026-09-02 15:51 local, **every** `mcp__workspace__bash` call in **every** Cowork session is refused without a prompt:

```
Permission to use mcp__workspace__bash has been denied.
```

audit.jsonl:
```json
{"type":"system","subtype":"permission_denied","tool_name":"mcp__workspace__bash","decision_reason_type":"rule", ...}
"tool_result_meta":[{"non_execution_kind":"permission-rule"}]
```

Happens in permission modes `auto`, `default` (Manual) and in sessions that previously ran in `bypassPermissions`. File tools, Obsidian MCP and other MCP tools keep working. Last successful run in `%LOCALAPPDATA%\Claude\Logs\main.log`: `15:30:24 [workspaceMcpServer] bash done: exit=0`.

## What I ruled out
- No `deny` rules in `~/.claude/settings.json`, `settings.local.json`, session `outputs/.claude/settings.local.json`, or `~/.claude.json`
- No `C:\ProgramData\ClaudeCode\managed-settings.json`, no `HKLM/HKCU\SOFTWARE\Policies\{ClaudeCode,Anthropic,Claude}`
- `cowork-policy-limits-cache.json` only contains `enforce_web_search_mcp_isolation`
- No Desktop setting that toggles shell access (searched de-DE.json strings)

## Root cause (as far as I can see)
The Desktop app spawns the CLI with (from `Win32_Process.CommandLine`):

```
--disallowedTools Bash,PowerShell,NotebookEdit,REPL,JavaScript,WebFetch
--allowedTools …,mcp__workspace__bash
--tools Task,Glob,Grep,Read,Edit,Write,…
```
plus tool aliases `Bash → mcp__workspace__bash`, `WebFetch → mcp__workspace__web_fetch`.

The permissions docs now state: *"Claude Code also applies deny rules that name the whole `Bash` or `WebFetch` tool to these Cowork tools … Allow rules don't carry over."* With 2.1.258 that propagation apparently applies to the `--disallowedTools Bash` entry the Desktop app itself passes, so the app's own deny beats its own allow and the aliased tool is dead. Same for `mcp__workspace__web_fetch`.

## Expected
`--disallowedTools Bash` (meant to hide the built-in Bash because it is aliased) must not deny the aliased Cowork tool that the same command line explicitly allows.

## Workaround
None found on the user side. Using the Code tab / Claude Code CLI instead of Cowork for anything that needs a shell.

Start by tracing handling of --disallowedTools, --allowedTools, and the Bash → mcp__workspace__bash alias, comparing bundled versions 2.1.255 and 2.1.258. Use audit.jsonl and %LOCALAPPDATA%\Claude\Logs\main.log to confirm the permission-rule decision. Done means the explicitly allowed Cowork bash tool is no longer denied while the built-in Bash remains disallowed; verify the analogous web_fetch behavior too.

由索引模型根据 Issue 内容生成。