Feature request: Allow-list specific shell command patterns for tool permissions

### Describe the feature or problem you'd like to solve

_No response_

### Proposed solution

Currently, /allow-all is the only way to skip per-invocation confirmation prompts. A more granular option would be useful: the ability
to pre-approve specific command patterns (e.g. uv run path/to/script.py) so that trusted scripts can run without confirmation while
everything else remains at normal permission level.

Use case: a local write-guard script already enforces its own confirmation and audit logging. Copilot adding a
second confirmation on top of the script's own guard creates redundant friction without additional safety benefit.

### Example prompts or workflows

_No response_

### Additional context

_No response_

No files or tests are named. Start by tracing the existing /allow-all permission and confirmation flow, then determine how command patterns should be matched and what happens for non-matching commands; done means trusted patterns avoid redundant prompts while all other commands retain normal confirmation.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.