Ability to add exceptions to prefix_rule forbid/prompt

What variant of Codex are you using?

CLI

What feature would you like to see?

Currently, more restrictive rules always have higher priority than less restrictive rules, so for example a rule that forbids, or requires a prompt for commands that start with "cmd" will have higher priority than a rule that allows ["cmd", "subcommand"].

This effectively makes it impossible to express something like "require a prompt for any command that starts with X, unless it uses one of these subcommands".

As a concrete example, I would like to require a prompt for most tofu commands, but want to allow a subset of them (tofu fmt and tofu validate), but there isn't a good way to do this.

Additional information

One seeming workaround for this is to use a denylist of subcommands to block. However, this is lest effective than one would hope, because it is trivial to bypass it by putting an option between the main command and the subcommand so the prefix doesn't match. That problem could possibly be worked around if prefix_rule had some form of wildcard matching and/or a way to tell it to ignore options starting wtih "-" (at least for some use cases).

Start by tracing the CLI's prefix_rule evaluation and how restrictive rules are prioritized. Define how exceptions should interact with forbid and prompt rules, including the tofu fmt and tofu validate examples, then verify the chosen behavior against option placement and rule-matching cases.