[BUG] allowedTools `Bash(printf *)` denies `printf x > file` with no message that output redirection defeated the prefix rule

### Preflight Checklist
- [x] I have searched existing issues and this hasn't been reported yet (nearest: #94314 covers `;`/`&&` compound-command matching in allow rules; this is the output-redirect case, and specifically the missing explanation in the denial)
- [x] This is a single bug report
- [x] I am using the latest version of Claude Code

### What's Wrong?
With `--allowedTools 'Bash(printf *)'`, the plain command `printf x` runs, but `printf x > redirected.txt` is denied, and nothing in the output says the redirect is why. The `permission_denials` entry names the tool and command only. From the outside the denial is indistinguishable from a missing or malformed allow rule, so operators running unattended sessions have no signal what to change.

Repro, in an empty scratch directory, default login, project settings only so user settings add no permissions:

```bash
env -u ANTHROPIC_API_KEY claude -p --output-format json --model sonnet \
--setting-sources project --allowedTools 'Bash(printf *)' --permission-prompts none \
'Use Bash to run exactly: printf x > redirected.txt. Then answer CREATED if the tool ran, DENIED if the tool was denied.' redirected.txt","description":"Write x to redirected.txt"}}],"result":"DENIED"}
# ls redirected.txt -> does not exist

# plain form, same rule: runs
{"subtype":"success","is_error":false,"terminal_reason":"completed","num_turns":2,"permission_denials":[],"result":"OUTPUT x"}
```

### Environment
- Claude Code 2.1.273 (reproduced), macOS 15
- Model: sonnet
- Context: headless sessions with narrow allowlists; we now default those sessions to `--permission-mode acceptEdits` because prefix allowlists cannot be trusted against write forms

Start by running the two provided headless Claude Code commands and compare the permission_denials entries for the plain and redirected forms. Trace the allowedTools prefix matching and denial-message paths, then verify that redirected commands either match the documented rule or explain why they do not, including the rule and redirect form in both reported denial locations.

Written by the indexing model from the issue text.