Command substitution block should be user-configurable, not a hardcoded wall

### What would you like to be added?

A `allowCommandSubstitution` toggle in `settings.json` (defaulting to `false`) that lets users opt out of the hardcoded command substitution block. In YOLO mode, this should either default to `true` or surface a warning instead of a silent block so the model can adapt its approach.

### Why is this needed?

The current hardcoded block creates two problems:

1. **Token/turn waste** — the model writes out a full command with `$()` substitution, the CLI blocks it at execution time, and the entire turn is wasted with nothing to show for it. The model has no way to know in advance the command will be blocked.

2. **YOLO mode contradiction** — in YOLO mode the user has explicitly opted into "run everything without asking me." Silently blocking an entire command class undercuts that contract without any warning.

A configurable toggle keeps the safe default for everyone while letting users who understand the risk opt out.

### Additional context

Reproduction: run any agentic task that requires command substitution (e.g. security triage, process inspection) in YOLO mode. The model generates a valid command, the CLI blocks it silently, the turn is lost, and the tokens still count against the user's quota — making this a compounding cost with no output to show for it.