bug: allowedTools glob patterns don't match broadly until at least one @-referenced server entry is included.

Dieses Issue hat noch niemand übernommen.

### Checks

- [x] I have searched [github.com/aws/amazon-q-developer-cli/issues](https://github.com/aws/amazon-q-developer-cli/issues?q=) and there are no duplicates of my issue
- [x] I have run `q doctor` in the affected terminal session
- [x] I have run `q restart` and replicated the issue again

### Operating system

macOS 15.6.1

### Expected behaviour

The following should allow all appropriately-named **"read"** tools, including those included by some defined MCP server, but the tools for loaded MCP servers will not match until at least one reference to the @-prefixed MCP server is included in the `allowedTools` list.

```json
"allowedTools": [
"*read*",
"*Read*",
],
```

_(Related recent wildcard implementation ticket: https://github.com/aws/amazon-q-developer-cli/pull/2612)_

### Actual behaviour

The simple configuration shown above yields this trust result for the configured `dujour-mcp`:
```
dujour-mcp (MCP):
- MyCoolReadTool * not trusted
- MyCoolWriteTool * not trusted
```

Modifying the configuration with the addition of `@dujour-mcp/anystring` will trigger the matching across all tools in the referenced MCP server (`@dujour-mcp`):
```json
{
"allowedTools": [
"@dujour-mcp/anystring",

"*read*",
"*Read*",
],

}
```
Modified trust result:
```
dujour-mcp (MCP):
- MyCoolReadTool * trusted
- MyCoolWriteTool * not trusted
```

### Steps to reproduce

Include the following in your CLI Agent configuration with and without the `@dujour-mcp/_` entry and observe the tools being trusted or not. (the `_` can be any string, actually matching or not)

```json
{
"allowedTools": [
"@dujour-mcp/_",

"*read*",
"*Read*",
],
}
```

### Environment

```yaml
[q-details]
version = "1.15.0"
hash = "eb8db5c635fc469f3bd94ead16bb4bfb32d7443b"
date = "2025-09-02T17:57:24.662205Z (13d ago)"
variant = "full"

[system-info]
os = "macOS 15.6.1 (24G90)"
chip = "Apple M1 Pro"
total-cores = 10
memory = "32.00 GB"

[environment]
cwd = "/Users/USER/.aws/amazonq"
cli-path = "/Users/USER/.aws/amazonq"
os = "Mac"
shell-path = "/bin/zsh"
shell-version = "5.9"
terminal = "Wezterm"
install-method = "unknown"

[env-vars]
DISPLAY = "/private/tmp/com.apple.launchd.FASneGMmqW/org.xquartz:0"
PATH = "/Users/USER/.local/share/mise/installs/node/20.19.5/bin:/Users/USER/.local/share/mise/installs/go/1.25.1/bin:/Users/USER/.local/share/mise/installs/python/3.13.7t/bin:/Users/USER/.local/share/mise/installs/ruby/3.4.5/bin:/opt/homebrew/bin:/opt/homebrew/sbin:/Users/USER/bin:/usr/local/bin:/usr/local/sbin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin:/opt/X11/bin:/Users/USER/.cargo/bin:/Users/USER/.local/bin:/Users/USER/.toolbox/bin:/Users/USER/Library/Application Support/JetBrains/Toolbox/scripts:/Users/USER/.scripts:/Users/USER/Documents/scripts:/usr/local/Cellar/ec2-api-tools/1.7.3.0/libexec/bin:/usr/local/IAM-current/bin"
QTERM_SESSION_ID = "84b316e1984c4291bf9bf091f48a860f"
Q_SET_PARENT_CHECK = "1"
Q_TERM = "1.15.0"
Q_USING_ZSH_AUTOSUGGESTIONS = "1"
SHELL = "/bin/zsh"
TERM = "xterm-256color"
__CFBundleIdentifier = "com.github.wez.wezterm"
```

Reproduziere zuerst die allowedTools-Konfiguration mit und ohne den Eintrag @dujour-mcp/_, nachdem du q doctor und q restart wie beschrieben ausgeführt hast. Verfolge das Glob-Matching für Tools, die von einem MCP-Server geladen wurden; abgeschlossen ist die Aufgabe, wenn *read* und *Read* übereinstimmende Toolnamen ohne jeglichen @-präfixierten Serververweis vertrauen, mit Regressionstests für beide Konfigurationen.

Vom Indexierungsmodell aus dem Issue-Text verfasst.