Assisted permissions: compound command containing a local script path always requires explicit approval (1.137.0 regression)

Hello. 1.137.0 seems to have introduced a regression in the assisted permissions behaviour.

Previously agent-run commands which were safe but difficult to write auto-approve regexes for (like running safe Ruby via the `rails runner` command) were caught during manual approvals but went through under assisted approvals.

Those same commands are now *sometimes* approved by the assisted permissions, but only when certain conditions are met. Specifically it seems it will not approve commands which a) invoke a local script and b) contain a compound command:

This is an issue because agents, especially in a Rails context, love to append exit-code checks to commands, and it's hard to reliably steer them into one pattern or another.

Here's the agent's writeup with a framework-agnostic reproduction:

Setup: VS Code 1.137.0, Copilot harness on the agent host, folder
isolation, Assisted permissions. macOS 26 arm64.
@github/copilot 1.0.84.70, @github/copilot-sdk 1.0.13-preview.4

Repro:
```
printf '#!/bin/sh\necho hi\n' > ./x && chmod +x ./x
ask the agent to run ./x -> approved, runs
ask the agent to run ./x; echo done -> "This script invocation cannot
be reviewed in full, so it
requires explicit approval."
```
Also approved on 1.137.0:
```
bin/rails runner 'puts 1 + 1'
bundle exec rails runner 'puts 1 + 1'; echo done
git log --oneline -5; echo done
echo '{}' | json_pp
```
Declined on 1.137.0:
```
bin/rails runner 'puts 1 + 1'; echo done
bin/dv --help 2>&1 | head -60
```
All of these run without approval on 1.136.2 in an otherwise identical
session.

The trigger is a compound command in which a subcommand names a local
file path. Neither part alone triggers it: the path is fine standalone,
and the compound is fine when the same program is resolved via PATH
(bundle exec) rather than named as a path.

Suspected cause: #333249, which enables enableScriptSafety on
agent-host sessions in this milestone.

Two issues:
1. The classifier declines to reach a verdict on a command it approves
when a trailing "; echo done" is removed.
2. Its non-verdict pre-empts the LLM judge. Assisted permissions exists
to assess commands static rules cannot classify, so a classifier
that cannot classify should defer to the judge, not short-circuit
to a prompt.

In a Rails codebase most work routes through bin/*, so in practice this
returns assisted permissions to manual mode.