Feature request: Allow-list specific shell command patterns for tool permissions

### Describe the feature or problem you'd like to solve

_No response_

### Proposed solution

Currently, /allow-all is the only way to skip per-invocation confirmation prompts. A more granular option would be useful: the ability
to pre-approve specific command patterns (e.g. uv run path/to/script.py) so that trusted scripts can run without confirmation while
everything else remains at normal permission level.

Use case: a local write-guard script already enforces its own confirmation and audit logging. Copilot adding a
second confirmation on top of the script's own guard creates redundant friction without additional safety benefit.

### Example prompts or workflows

_No response_

### Additional context

_No response_