Granular bash permission rules (#7091)

* fix: renamed pattern arrays used for permission rules

* fix: rename savePatternRules to saveAlwaysRules

* feat: generate hierarchical always patterns in bash tool

* feat: validate saveAlwaysRules against always array only

* feat: pass always field through extension bridge to webview

* feat: show hierarchical always patterns in PermissionDock dropdown

* fix: rename pattern to rule in PermissionDock translations, styles, and data-slots

* fix(vscode): correct auto-run comment in PermissionDock

* feat(kilo-vscode): strip trailing wildcard from permission rule labels

* fix: deduplicate permission rules and strip wildcards from display labels

* refactor: move hierarchy to metadata.rules, restore always to arity prefix

* feat: pass always field to permission dock for non-bash tool rules

* fix: correct bash test assertion to check metadata.rules and fix indentation

* fix: hide permission rules dropdown for non-bash tools

* fix: align always-rules route descriptions, whitespace, and restore multi-command tests

packages/opencode/test/tool/bash.test.ts

@@ -306,8 +306,10 @@ describe("tool.bash permissions", () => {
         await bash.execute({ command: "ls -la", description: "List" }, testCtx)
         const bashReq = requests.find((r) => r.permission === "bash")
         expect(bashReq).toBeDefined()
-        const pattern = bashReq!.always[0]
-        expect(pattern).toBe("ls *")
+        // kilocode_change start — hierarchy adds base wildcard + exact
+        expect(bashReq!.always).toContain("ls *")
+        expect(bashReq!.metadata.rules).toContain("ls -la")
+        // kilocode_change end
       },
     })
   })