Server-side tools are unblockable: deny rejects the registered casing, and PreToolUse hooks never fire for them

## Summary
Two related defects that combine to make a server-side tool impossible to block by any user-controllable mechanism (verified on Claude Code 2.1.259, Windows 11).

## Defect 1 — settings schema forces a casing the permission matcher cannot match
A session exposes a tool whose registered name is lowercase `advisor` (visible in the session's own tool schema).
- Adding `"advisor"` to `permissions.deny` is rejected by the settings validator: `Tool names must start with uppercase. Use "Advisor"`.
- Adding `"Advisor"` passes validation but produces the startup warning: `Permission deny rule "Advisor" matches no known tool — check for typos.`
- Verified with a positive control: a deliberately bogus deny entry (`"Zzznotatool"`) produces the identical warning, proving the warning mechanism works and that `Advisor` genuinely matches nothing.

So no spelling both validates and matches: the tool cannot be denied through settings.

## Defect 2 — PreToolUse hooks do not fire for server-side tools
As a fallback we registered a PreToolUse hook with matcher `[Aa]dvisor` (registration confirmed in OTEL telemetry: `hook_registered`, `hook_event: "PreToolUse"`, `hook_matcher: "[Aa]dvisor"`). A deliberate advisor invocation in a test session then executed end-to-end with no block and no hook execution event in telemetry — the tool runs server-side, inside the API request, so it never passes through the client tool pipeline that hooks and permission checks intercept.

## Combined impact
A server-side tool injected into a session cannot be blocked by deny rules (defect 1) or hooks (defect 2) — only by prompt text, which loses to the harness re-injecting the tool's call-it-first instruction each session. Aggravating: the defect-1 startup warning prints only on CLI launches; IDE-extension sessions never surface it, so a non-binding deny rule survives invisibly.

## Expected
Either (a) the schema accepts the registered casing / matching is case-insensitive, and (b) permission rules and PreToolUse hooks cover server-side tools — or session configuration offers a way to exclude an injected server-side tool.

## Environment
Claude Code 2.1.259 · Windows 11 (10.0.26200) · observed in both CLI and VSCode-extension sessions

Start with the settings validator and permission matcher for registered tool names, then trace the PreToolUse hook path for server-side tools. Reproduce with a lowercase `advisor` tool in CLI and VSCode-extension sessions, checking the stated OTEL events and startup warning. Done means the registered tool can be denied and PreToolUse hooks can block it, or session configuration can exclude it.

索引モデルが issue の本文から書いたものです。