bug: Conflict between agent configs - toolSettings and allowedTools

### Checks

- [x] I have searched [github.com/aws/amazon-q-developer-cli/issues](https://github.com/aws/amazon-q-developer-cli/issues?q=) and there are no duplicates of my issue
- [x] I have run `q doctor` in the affected terminal session
- [x] I have run `q restart` and replicated the issue again

### Operating system

MacOS

### Expected behaviour

When `fs_write` is not added to the list of `allowedTools`, then having a field for fs_write in "toolSettings" should not assume fs_write is trusted.

- `allowedTools` should take precedence over toolSettings, at least for fs_write. `allowedTools` should be the only source of truth for trust settings.

### Actual behaviour

When `fs_write` in present in `toolSettings` of cli-agent configuration, it assumes fs_write is trusted even when allowedTools does not contain fs_write.

Also, running `/tools` in this case does not show fs_write as trusted, even though it is used as a trusted tool.

### Steps to reproduce

1. Add some toolSettings for fs_write - say `allowedPaths` in a cli-agent configuration
2. Start q chat with the agent loaded.
3. Ask it to make changes to a file in the configured allowedPaths. It will proceed to do so as a trusted tool.
4. Check `/tools`, which shows fs_write as not trusted.

### Environment

```yaml
[q-details]
version = "1.15.0"
hash = "eb8db5c635fc469f3bd94ead16bb4bfb32d7443b"
date = "2025-09-02T17:57:24.662205Z (13d ago)"
variant = "full"

[system-info]
os = "macOS 15.6.1 (24G90)"
chip = "Apple M1 Pro"
total-cores = 10
memory = "32.00 GB"

...
```

Inizia riproducendo la configurazione di cli-agent con fs_write in toolSettings, ma assente da allowedTools; quindi confronta il comportamento dello strumento con la visualizzazione /tools dopo aver eseguito q restart. Traccia il modo in cui allowedTools e toolSettings determinano l’attendibilità e considera l’issue completata quando sia l’esecuzione sia /tools trattano coerentemente fs_write come non attendibile, a meno che allowedTools non lo includa.

Scritto dal modello di indicizzazione a partire dal testo della issue.