bug: Agent tool scoping is not working properly.

### Checks

- [x] I have searched [github.com/aws/amazon-q-developer-cli/issues](https://github.com/aws/amazon-q-developer-cli/issues?q=) and there are no duplicates of my issue
- [x] I have run `q doctor` in the affected terminal session
- [x] I have run `q restart` and replicated the issue again

### Operating system

Apple M1 Macbook Pro

### Expected behaviour

When adding an allowlisted scoped permission to the `allowedPaths` of the `toolsSettings` to an agent config, I expect the agent to run that approved tool in the provided path without asking for permission to execute.

### Actual behaviour

When running the tool in that provided path, the tool asks for permissions to execute anyway. This causes the command to fail completely in `--no-interactive` mode.

### Steps to reproduce

Set up an agent config with the following (I'm using a package level agent):
```
"allowedTools": [
"fs_read"
],
"toolsSettings": {
"fs_write": {
"allowedPaths": [
"route/to/package/not/in/package/level"
]
},
```

And run

`q chat --agent migration-tool-developer "add const trueFlag = true to '/Users/qmaki/workplace/DemoRepo/src/DemoRepo/src/utils/demoFile.ts'" --non-interactive`.

I (and members on my team) are getting:

`error: Tool approval required but --no-interactive was specified. Use --trust-all-tools to automatically approve tools.`

Specific configurations with my specific project:

```
migration-tool-developer.json:

{
"name": "migration-tool-developer",
"description": "AI-powered design system migration tool developer - builds and maintains the [REDACTED-2]",
"model": "claude-sonnet-4",
"prompt": "file://./prompts/migration-tool-developer.md",
"resources": [
"file://./prompts/project-context.md",
"file://./prompts/amazon-dev-instructions.md"
],
"tools": [
"fs_read",
"fs_write",
"execute_bash"
],
"allowedTools": [
"fs_read"
],
"toolsSettings": {
"fs_write": {
"allowedPaths": [
"./src/**",
"./migration_templates/**",
"./migration_details/**",
"./*.json",
"./*.js",
"./*.ts",
"./*.md",
"/Users/qmaki/workplace/[REDACTED-1]/src/[REDACTED-1]/**"
]
},
"execute_bash": {
"allowedCommands": [
"brazil-build [^;&|]*",
"npm [^;&|]*",
"node [^;&|]*",
"git status [^;&|]*",
"git add [^;&|]*",
"git commit [^;&|]*",
"git diff [^;&|]*",
"cr [^;&|]*",
"find.*",
"grep.*",
"mkdir.*",
"cd .*",
"awk .*"
],
"autoAllowReadonly": true
}
}
}
```

Path of agent:
`/Users/qmaki/workplace/[REDACTED-2]/src/[REDACTED-2]/.amazonq/cli-agents`

Path of target:
`/Users/qmaki/workplace/[REDACTED-1]/src/[REDACTED-1]`

Q CLI output:
```
➜ ~ q chat --agent migration-tool-developer "add const trueCheck = true to '/Users/qmaki/workplace/[REDACTED-1]/src/[REDACTED-1]/src/utils/featureFlags.ts'" --non-interactive

⢠⣶⣶⣦⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣤⣶⣿⣿⣿⣶⣦⡀⠀
⠀⠀⠀⣾⡿⢻⣿⡆⠀⠀⠀⢀⣄⡄⢀⣠⣤⣤⡀⢀⣠⣤⣤⡀⠀⠀⢀⣠⣤⣤⣤⣄⠀⠀⢀⣤⣤⣤⣤⣤⣤⡀⠀⠀⣀⣤⣤⣤⣀⠀⠀⠀⢠⣤⡀⣀⣤⣤⣄⡀⠀⠀⠀⠀⠀⠀⢠⣿⣿⠋⠀⠀⠀⠙⣿⣿⡆
⠀⠀⣼⣿⠇⠀⣿⣿⡄⠀⠀⢸⣿⣿⠛⠉⠻⣿⣿⠛⠉⠛⣿⣿⠀⠀⠘⠛⠉⠉⠻⣿⣧⠀⠈⠛⠛⠛⣻⣿⡿⠀⢀⣾⣿⠛⠉⠻⣿⣷⡀⠀⢸⣿⡟⠛⠉⢻⣿⣷⠀⠀⠀⠀⠀⠀⣼⣿⡏⠀⠀⠀⠀⠀⢸⣿⣿
⠀⢰⣿⣿⣤⣤⣼⣿⣷⠀⠀⢸⣿⣿⠀⠀⠀⣿⣿⠀⠀⠀⣿⣿⠀⠀⢀⣴⣶⣶⣶⣿⣿⠀⠀⠀⣠⣾⡿⠋⠀⠀⢸⣿⣿⠀⠀⠀⣿⣿⡇⠀⢸⣿⡇⠀⠀⢸⣿⣿⠀⠀⠀⠀⠀⠀⢹⣿⣇⠀⠀⠀⠀⠀⢸⣿⡿
⢀⣿⣿⠋⠉⠉⠉⢻⣿⣇⠀⢸⣿⣿⠀⠀⠀⣿⣿⠀⠀⠀⣿⣿⠀⠀⣿⣿⡀⠀⣠⣿⣿⠀⢀⣴⣿⣋⣀⣀⣀⡀⠘⣿⣿⣄⣀⣠⣿⣿⠃⠀⢸⣿⡇⠀⠀⢸⣿⣿⠀⠀⠀⠀⠀⠀⠈⢿⣿⣦⣀⣀⣀⣴⣿⡿⠃
⠚⠛⠋⠀⠀⠀⠀⠘⠛⠛⠀⠘⠛⠛⠀⠀⠀⠛⠛⠀⠀⠀⠛⠛⠀⠀⠙⠻⠿⠟⠋⠛⠛⠀⠘⠛⠛⠛⠛⠛⠛⠃⠀⠈⠛⠿⠿⠿⠛⠁⠀⠀⠘⠛⠃⠀⠀⠘⠛⠛⠀⠀⠀⠀⠀⠀⠀⠀⠙⠛⠿⢿⣿⣿⣋⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠛⠿⢿⡧

╭─────────────────────────────── Did you know? ────────────────────────────────╮
│ │
│ /usage shows you a visual breakdown of your current context window │
│ usage │
│ │
╰──────────────────────────────────────────────────────────────────────────────╯

/help all commands • ctrl + j new lines • ctrl + s fuzzy search
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
🤖 You are chatting with claude-sonnet-4

Checkpoints are not available in this directory. Use '/checkpoint init' to enable checkpoints.

> I'll add the feature flag constant to the specified file.

🛠️ Using tool: fs_read (trusted)
⋮
● Reading file: /Users/qmaki/workplace/[REDACTED-1]/src/[REDACTED-1]/src/utils/featureFlags.ts, all lines
✓ Successfully read 3068 bytes from /Users/qmaki/workplace/[REDACTED-1]/src/[REDACTED-1]/src/utils/featureFlags.ts
⋮
● Completed in 0.0s

🛠️ Using tool: fs_write
⋮
● Path: ../../Volumes/workplace/[REDACTED-1]/src/[REDACTED-1]/src/utils/featureFlags.ts

- 98 : );
+ 98: );
+ 99:
+ 100: export const trueCheck = true;

⋮
↳ Purpose: Add trueCheck constant to feature flags
error: Tool approval required but --no-interactive was specified. Use --trust-all-tools to automatically approve tools.
➜ ~ q chat --agent migration-tool-developer "add const isContinuumMigrationEnabled = true to '/Volumes/workplace/[REDACTED-1]/src/[REDACTED-1]/src/utils/featureFlags.ts'" --non-interactive
```

### Environment

```yaml
[q-details]
version = "1.19.4"
hash = "d1c473eaf5578603895f6d4975536fcb2c043eaa"
date = "2025-11-07T19:12:16.55651Z (3d ago)"
variant = "full"

[system-info]
os = "macOS 15.7.1 (24G231)"
chip = "Apple M1 Pro"
total-cores = 10
memory = "32.00 GB"

[environment]
cwd = "/Volumes/workplace/[REDACTED-1]/src/[REDACTED-1]"
cli-path = "/Volumes/workplace/[REDACTED-1]/src/[REDACTED-1]"
os = "Mac"
shell-path = "/Users/USER/.toolbox/tools/toolbox/1.1.2306.0/toolbox-exec"
shell-version = "5.9"
terminal = "iTerm 2"
install-method = "toolbox"

[env-vars]
PATH = "/Users/USER/.config/smithy-mcp/mcp-servers:/Users/USER/.toolbox/bin:/Users/USER/.local/bin:/Users/USER/.nvm/versions/node/v20.19.2/bin:/Users/USER/.toolbox/bin:/Users/USER/.toolbox/bin:/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/Library/Apple/usr/bin:/Users/USER/Library/Application"
SHELL = "/bin/zsh"
TERM = "xterm-256color"
__CFBundleIdentifier = "com.googlecode.iterm2"
```