[Bug] Permission check incorrectly rejects fully qualified paths in `cmd /c` commands

**Bug Description**
The permission check appears to incorrectly reject commands that use fully qualified absolute paths when they are executed through `cmd /c`.

For example, Claude Code generated:

`cd "D:\\" && cmd /c ""D:\\\gradlew.bat" build" 2>&1`

The path to `gradlew.bat` is fully qualified and clearly resides inside the working directory. There are no relative paths involved.

Nevertheless, Claude Code reports:

`cmd names a path that is computed at run time, which cannot be checked against the read block (permissions.blockReadsOutsideWorkingDirectories)`

This seems overly conservative and misleading. The permission system should be able to resolve the absolute path passed to `cmd /c` and verify that it is within the allowed working directory.

The error message is especially confusing because it refers to `cmd` as naming a runtime-computed path, even though the actual target path is explicitly specified as an absolute path in the command.

This is particularly problematic on Windows, where invoking `.bat` files through `cmd /c` is a normal and legitimate execution pattern.

**Environment Info**
- Platform: win32
- Terminal: pycharm
- Version: 2.1.270
- Feedback ID: fb6eb062-f53b-439c-9d9a-69c7beff98ec

**Errors**
```json
[]
```

Reproduce the reported command on win32, using the fully qualified gradlew.bat path through cmd /c. Trace the permission check for cmd /c commands and absolute paths, then verify that an in-directory path is accepted and that the misleading runtime-computed-path message no longer appears.

Written by the indexing model from the issue text.